Update AAD token request target resource uri for ACR access

src/Microsoft.Health.Fhir.Azure/ContainerRegistry/AzureContainerRegistryAccessTokenProvider.cs

@@ -59,7 +59,7 @@ public async Task<string> GetTokenAsync(string registryServer, CancellationToken
         {
             EnsureArg.IsNotNullOrEmpty(registryServer, nameof(registryServer));
 
-            var aadResourceUri = new Uri(_convertDataConfiguration.ArmResourceManagerId);
+            var aadResourceUri = new Uri(_convertDataConfiguration.AcrTargetResourceUri);
             string aadToken;
             try
             {

src/Microsoft.Health.Fhir.Core/Configs/ConvertDataConfiguration.cs

@@ -22,11 +22,12 @@
         public ICollection<string> ContainerRegistryServers { get; } = new List<string>();
 
         /// <summary>
-        /// ArmResourceManagerId to aquire AAD token for ACR access token since ACR is not an AAD resource.
-        /// The value is "https://management.azure.com/" for AzureCloud and DogFood.
-        /// Could be changed to "https://management.usgovcloudapi.net/" for Azure Government and "https://management.chinacloudapi.cn/ " for Azure China.
+        /// AcrTargetResourceUri to acquire AAD token for ACR access token since ACR is not an AAD resource. 
+        /// To enable Trusted Services scenarios, we must use the ACR-specific URI rather than the more generic ARM URI.
+        /// https://dev.azure.com/msazure/AzureContainerRegistry/_wiki/wikis/ACR%20Specs/480000/TrustedServicesPatterns
+        /// The value is "https://containerregistry.azure.net/" for AzureCloud and DogFood.
         /// </summary>
-        public string ArmResourceManagerId { get; set; } = "https://management.azure.com/";
+        public string AcrTargetResourceUri { get; set; } = "https://containerregistry.azure.net/";
 
         /// <summary>
         /// Configuration for templates.