In my team, we've got two scripts
Allow the web app to communicate with the container registry -- adding the IP of the web app to the ACR network settings
Adding the IP of the build agent to the container registry -- script that gets the IP of the azure devops build agent and we add that to the ACR network settings