{"record":{"id":"644232c6a9dcb188","repo":"microsoft/aspire","slug":"endpoint-resolvedendpoint-endpoint-name-on-resource-resource-644232","errorCode":null,"errorMessage":"Endpoint '{resolvedEndpoint.Endpoint.Name}' on resource '{resource.TargetResource.Name}' shares target port {resolvedTargetPort} with endpoint '{existingEndpoint.Name}' but configures a different anonymous-access policy. Azure sandbox ports support a single access policy per target port.","messagePattern":"Endpoint '(.+?)' on resource '(.+?)' shares target port (.+?) with endpoint '(.+?)' but configures a different anonymous-access policy\\. Azure sandbox ports support a single access policy per target port\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs","lineNumber":1532,"sourceCode":"                resolvedEndpoint.Endpoint.Name,\n                resolvedTargetPort,\n                IsExternal: true,\n                IsHttp: true,\n                protocol,\n                resolvedEndpointOptions?.Anonymous);\n\n            if (endpoints.TryGetValue(resolvedTargetPort, out var existingEndpoint))\n            {\n                if (!string.Equals(existingEndpoint.Protocol, endpoint.Protocol, StringComparison.Ordinal))\n                {\n                    throw new NotSupportedException($\"Endpoint '{resolvedEndpoint.Endpoint.Name}' on resource '{resource.TargetResource.Name}' shares target port {resolvedTargetPort} with endpoint '{existingEndpoint.Name}' but uses a different transport. Azure sandbox ports support a single HTTP protocol per target port.\");\n                }\n\n                if (existingEndpoint.Anonymous is not null &&\n                    endpoint.Anonymous is not null &&\n                    existingEndpoint.Anonymous != endpoint.Anonymous)\n                {\n                    throw new NotSupportedException($\"Endpoint '{resolvedEndpoint.Endpoint.Name}' on resource '{resource.TargetResource.Name}' shares target port {resolvedTargetPort} with endpoint '{existingEndpoint.Name}' but configures a different anonymous-access policy. Azure sandbox ports support a single access policy per target port.\");\n                }\n\n                endpoints[resolvedTargetPort] = existingEndpoint with\n                {\n                    IsExternal = existingEndpoint.IsExternal || endpoint.IsExternal,\n                    IsHttp = existingEndpoint.IsHttp || endpoint.IsHttp,\n                    Anonymous = existingEndpoint.Anonymous ?? endpoint.Anonymous\n                };\n            }\n            else\n            {\n                endpoints.Add(resolvedTargetPort, endpoint);\n            }\n        }\n\n        if (unmatchedEndpointOptions is { Count: > 0 })\n        {\n            throw new InvalidOperationException($\"Resource '{resource.TargetResource.Name}' has Azure sandbox endpoint options for endpoint(s) that are not exposed by EndpointAnnotation: {string.Join(\", \", unmatchedEndpointOptions)}.\");","sourceCodeStart":1514,"sourceCodeEnd":1550,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs#L1514-L1550","documentation":"A sandbox target port carries a single anonymous-access policy. When two endpoints on the same target port both set Anonymous but with different boolean values, the merged ingress configuration would be ambiguous, so NotSupportedException is thrown.","triggerScenarios":"Endpoints sharing resolvedTargetPort where existingEndpoint.Anonymous and endpoint.Anonymous are both non-null and unequal (one requires auth, the other allows anonymous).","commonSituations":"Mixing WithEndpoint options / sandbox endpoint options across endpoints on one port, e.g. one endpoint marked public-anonymous and another authenticated on the same port.","solutions":["Align the anonymous-access setting on both endpoints for the shared port","Separate the endpoints onto different target ports","Remove the duplicate endpoint configuration"],"exampleFix":"// before\n.WithHttpEndpoint(targetPort: 8080) // anonymous: true via options\n.WithEndpoint(..., targetPort: 8080) // anonymous: false\n// after\n.WithHttpEndpoint(targetPort: 8080)\n.WithHttpEndpoint(targetPort: 8081) // different policy on its own port","handlingStrategy":"validation","validationCode":"var byPort = resource.Endpoints.GroupBy(e => e.TargetPort)\n    .Where(g => g.Select(e => e.Anonymous).Where(a => a is not null).Distinct().Count() > 1);\nif (byPort.Any()) throw new InvalidOperationException(\"Shared target port with mixed anonymous policies.\");","typeGuard":null,"tryCatchPattern":"try { DeploySandbox(...); } catch (NotSupportedException ex) when (ex.Message.Contains(\"single access policy per target port\")) { /* align Anonymous flags or split ports */ }","preventionTips":["Keep anonymous-access policy consistent per target port","Review sandbox endpoint options dictionaries for conflicting flags"],"tags":["azure","sandbox","endpoint","port-conflict","access-policy"],"backgroundTag":"conflicting-config-options","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}