You have an on-premises server named Server1 that runs Windows Server, has the Web Server...

You have an on-premises server named Server1 that runs Windows Server, has the Web Server (IIS) server role installed, and hosts an ASP.NET-based web app named App1.

You have an Azure subscription that contains an Azure App Service app and an Azure container registry named ACR1.

You plan to migrate App1 to an App Service container by using Azure Migrate. The container image for App1 will be stored in ACR1.

You need to ensure that the App Containerization tool can store the container for App1 in ACR1. The solution must follow the principle of least privilege.

Which credential should the App Containerization tool use?