Explanation You can use the Docker task to sign into ACR and then use a subsequent script to pull an image and scan the container image for vulnerabilities. Use the docker task in a build or release pipeline. This task can be used with Docker or Azure Container registry. References: https://docs.microsoft.com/en-us/azure/devops/articles/security-validation-cicd-pipeline?view=vsts