Access to our container registry breaks all the time for no reason anyone has been able to figure out. Not even the third party people we pay a lot of money to

Access to our container registry breaks all the time for no reason anyone has been able to figure out. Not even the third party people we pay a lot of money to help. Basically we now add both a managed ID to the AD group with pull rights, and we setup rights the old fashined way and now it works maybe 95% of the time. Sometimes it still doesn't, and usually the fix is to delete everything and deploy again. As far as actually running the build images, however, if they run in Docker locally then we never have issues with running them in the cloud.