Skip to content

Add Microsoft Defender for Cloud header values; clarify analytics-only usage #889

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
johnsonshi wants to merge 2 commits into
base: main
Choose a base branch
from
+15 −0
Open

Add Microsoft Defender for Cloud header values; clarify analytics-only usage #889

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0e76e1b
Add MDC source-client header values and clarify header usage scope
johnsonshi Jun 7, 2026
032b160
Add MDC image-enrichment source-client value
johnsonshi Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions docs/http-headers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,3 +66,18 @@ The values we ask ACR partners to use when populating the `X-Meta-Source-Client`
| VSTS | `azure/vsts` |
| ACR Tasks | `azure/acr/tasks` |
| ACR Connected Registry | `azure/acr/connected-registry/instance-1` |
| Microsoft Defender for Cloud - ACR scanner that pulls images for vulnerability assessment | `azure/mdc/scanner-svc-image-puller` |
| Microsoft Defender for Cloud - ACR scanner for registry discovery and metadata | `azure/mdc/scanner-svc-image-discovery` |
| Microsoft Defender for Cloud - ACR scanner for container image enrichment | `azure/mdc/scanner-svc-image-enrichment` |
| Microsoft Defender for Cloud - Azure DevOps CLI scanner that pulls images | `azure/mdc/scanner-ado-cli-image-puller` |

## How ACR uses this header

The `X-Meta-Source-Client` header is a client-supplied, unauthenticated, and untrusted value. Both Microsoft and non-Microsoft clients can set or modify it freely, and ACR does not validate it during requests. ACR uses this header **only** for telemetry — traffic analysis, aggregation, and attribution of request sources to understand usage patterns. Specifically, ACR does **not** use this header for:

- Authentication or authorization
- Throttling, rate limiting, or quota calculations or exemptions
- Request routing or prioritization
- Any other business or control-plane logic

Likewise, anything that observes or consumes this traffic or its telemetry — service meshes, proxies, gateways, traffic analyzers, monitoring systems, and business analytics dashboards or reports — should not take a trusted dependency on this header's value, since it is self-reported by the client.