The following Azure built-policy, when set to respective policy status, will block the user from enabling admin user on their registry.
Azure built-in policyPolicy statusAdmin status Configure container registries to disable local admin account.ModifyDisable Container registries should have local admin account disabled.DenyDisable Container registries should have local admin account disabled.Auditnon-compliant