Overprovisioned or Idle Azure Container Registry Tier

This means a registry with zero image pulls, zero pushes, and no active workloads consuming it still incurs the same daily charge as a heavily utilized one. Teams commonly provision Standard or Premium tiers as a default "production-safe" choice without evaluating whether the advanced capabilities exclusive to those tiers - such as geo-replication, private endpoints, connected registries, or customer-managed keys - are actually needed. The result is a persistent overspend on tier fees that deliver no incremental value.

This waste pattern is especially prevalent in organizations with decentralized container workflows. Registries created for short-lived projects, development and testing environments, or CI/CD pipelines are frequently left running long after their purpose has ended. Because Azure Container Registry has no free tier and cannot be paused or stopped - deletion is the only way to cease billing - these forgotten registries quietly accumulate fixed charges indefinitely. Across an organization with dozens of registries spread across teams and environments, the compounding effect of idle or over-tiered registries can represent a meaningful and entirely avoidable cost.

Azure Container Registry billing is driven by a fixed daily charge that varies by tier (SKU). The three available tiers are Basic, Standard, and Premium, with each tier commanding a progressively higher daily rate. Current rates are published on the Azure Container Registry pricing page.

• The daily tier charge is incurred continuously as long as the registry exists, regardless of image pull/push activity, number of stored images, or whether tier-specific features are in use.
• Each tier includes a set amount of storage (Basic: 10 GB, Standard: 100 GB, Premium: 500 GB). Storage beyond the included amount is billed at an additional daily rate per GiB.
• Network egress charges apply separately for data transferred between Azure regions or out of Azure, following standard Azure networking fees.
• Geo-replication, available only in the Premium tier, incurs the Premium daily rate for each replicated region - effectively multiplying the fixed tier charge across all replica locations.

Because the fixed daily charge is the dominant cost component for most registries, selecting a higher tier than necessary or leaving idle registries provisioned directly translates into waste.

• Identify all container registries across the organization and review their current tier (Basic, Standard, or Premium) alongside monthly spend per registry.
• Review registry activity over a representative period to identify registries with zero or near-zero image pull and push operations, indicating idle or abandoned registries.
• Assess whether registries on the Premium tier are actively utilizing Premium-exclusive features such as geo-replication, private endpoints, connected registries, or customer-managed keys - if none of these features are configured, the tier may be oversized.
• Do not count zone redundancy or Docker Content Trust as reasons to stay on Premium: zone redundancy is enabled by default on all tiers in supported regions, and Docker Content Trust is deprecated, cannot be enabled on new registries or on registries that had not enabled it before May 31, 2026, and is removed on March 31, 2028 in favor of Notary Project signing.
• Evaluate whether registries on the Standard tier require the additional storage or throughput over Basic, or whether the Basic tier would suffice for the workload.
• Identify registries associated with decommissioned projects, retired environments, or completed CI/CD pipelines that no longer serve an active purpose.
• Review whether multiple registries exist across teams or projects that could be consolidated into a shared registry using repository namespaces.

• Downgrade registries to the lowest tier that meets actual requirements - most development workloads and single-region production scenarios operate effectively on Basic or Standard. Before downgrading from Premium, remove any geo-replications, connected registries, or private endpoints, as these must be deleted before the SKU change can be applied.
• Delete idle registries that are no longer serving active workloads. Since registries cannot be paused or stopped, deletion is the only way to cease tier charges. Migrate any needed images to a shared organizational registry before decommissioning.
• Consolidate registries across teams and projects into a shared registry using repository namespace conventions and repository-scoped access controls, eliminating redundant fixed tier charges across the organization.
• Establish a periodic audit process to flag registries with minimal activity or unused Premium features, ensuring tier selections remain aligned with actual usage over time.
• Implement automated image cleanup policies to manage storage growth within registries, preventing unnecessary overage charges from stale or untagged images accumulating over time.

• Pricing - Container Registryazure.microsoft.com
• Azure Container Registry SKU Features and Limitslearn.microsoft.com
• Introduction to Azure Container Registrylearn.microsoft.com
• Best Practices for Using Azure Container Registrylearn.microsoft.com
• Geo-replication in Azure Container Registrylearn.microsoft.com
• Set Up Private Endpoint with Private Link for ACRlearn.microsoft.com
• Monitor Azure Container Registrylearn.microsoft.com
• Manage Signed Images with Docker Content Trust in Azure Container Registrylearn.microsoft.com