you might need to add acrUseManagedIdentityCreds to app service configuration. refer to this link, under 'Use managed identity to pull image from Azure Container Registry' section. https://learn.microsoft.com/en-us/azure/app-service/configure-custom-container?tabs=debian&pivots=container-linux#use-managed-identity-to-pull-image-from-azure-container-registry

az  webapp config set --resource-group <group-name> --name <app-name> --generic-configurations '{"acrUserManagedIdentityID": "<client-id>"}'