Hi, We have an existing azure container registry in different subscription (sub1) and we try to add this registry when create an azure container app in different subscription (sub2)

var containerApp= new ContainerApp(appName, new ContainerAppArgs
            {
                Configuration = new ConfigurationArgs
                {
                    Dapr = new DaprArgs
                   {
                     AppPort = 80,
                     AppProtocol = "http",
                     Enabled = true,
                   },
                    Ingress = new IngressArgs
                    {
                        External = false,
                        TargetPort = 80
                    },
                    Secrets = new InputList<SecretArgs>
                    {
                        new SecretArgs { Name = "registry-password", Value = "testpassword"}
                    },
                    Registries = new InputList<RegistryCredentialsArgs>   // From other subscription
                    {
                        new RegistryCredentialsArgs
                        {
                            Server ="<http://testacr.azurecr.io|testacr.azurecr.io>",
                            Username = "testacr",
                            PasswordSecretRef = "registry-password"
                        }
                    }
                }
}

but get ERROR: The resource with name 'testacr' and type 'Microsoft.ContainerRegistry/registries' could not be found in subscription 'sub2'. In workaround I have tried following CLI command to add registry from other subscription to container app and it works az containerapp registry set -n MyContainerapp -g MyResourceGroup --server MyExistingContainerappRegistry.azurecr.io --username MyRegistryUsername --password MyRegistryPassword Do we have any similar workaround in Pulumi?

Have you seen the Provider resource option https://www.pulumi.com/docs/intro/concepts/resources/options/provider/? It lets you set up a non-default default provider that’s using a different subscription and then just tell some resources to use that.

Strange. We are doing exactly the same and have no issues with the ContainerApp seeing the CR and being able to pull the image. We don't have it configured to use a different provider either. What Azure method are you authenticating with? AAD user or Service principal?