Admin user be checked, and then you can use azure container registry using docker login. I think this is mandatory when using simple docker login to pull image.
I have just test using Managed identity, and have the same role as yours, and works well.