{"record":{"id":"d0dc5cfa7cd92897","repo":"microsoft/aspire","slug":"compute-resource-resource-name-uses-managed-identity","errorCode":null,"errorMessage":"Compute resource '{resource.Name}' uses managed identity '{userAssignedIdentity.Name}', but workload identities are not supported when publishing to existing Azure sandbox group '{Name}'.","messagePattern":"Compute resource '(.+?)' uses managed identity '(.+?)', but workload identities are not supported when publishing to existing Azure sandbox group '(.+?)'\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs","lineNumber":241,"sourceCode":"                continue;\n            }\n\n            if (resource.GetDeploymentTargetAnnotation(this) is not null)\n            {\n                continue;\n            }\n\n            if (resource.TryGetLastAnnotation<AppIdentityAnnotation>(out var appIdentity))\n            {\n                if (appIdentity.IdentityResource is not AzureUserAssignedIdentityResource userAssignedIdentity)\n                {\n                    throw new NotSupportedException(\n                        $\"Compute resource '{resource.Name}' uses an application identity type that Azure sandboxes do not support.\");\n                }\n\n                if (this.IsExisting())\n                {\n                    throw new InvalidOperationException(\n                        $\"Compute resource '{resource.Name}' uses managed identity '{userAssignedIdentity.Name}', but workload identities are not supported when publishing to existing Azure sandbox group '{Name}'.\");\n                }\n\n                if (ReferenceEquals(imagePullIdentity, userAssignedIdentity))\n                {\n                    throw new InvalidOperationException(\n                        $\"Azure sandbox group '{Name}' uses identity '{userAssignedIdentity.Name}' for both image pulls and workload '{resource.Name}'. \" +\n                        \"Use a dedicated image-pull identity so its AcrPull permission is not exposed to sandbox workloads.\");\n                }\n\n                AddWorkloadUserAssignedIdentity(userAssignedIdentity);\n            }\n\n            AzureSandboxContainerDeployment.ValidateSandboxCompatibility(resource);\n\n            resource.Annotations.Add(new ContainerBuildOptionsCallbackAnnotation(static buildOptions =>\n            {\n                // ADC requires a single Docker-format linux/amd64 manifest. Buildx's default OCI","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs#L223-L259","documentation":"When publishing to an existing (pre-created) Azure sandbox group, the library does not manage the group, so it cannot create or assign workload user-assigned identities. A compute resource with an AppIdentityAnnotation targeting an existing sandbox group is therefore rejected.","triggerScenarios":"Calling PublishAsAzureSandbox / pointing a compute resource at a sandbox group created as existing (IsExisting() is true) while that compute resource has ConfigureAppIdentity/WithAppIdentity applied with an AzureUserAssignedIdentityResource.","commonSituations":"Pointing an app at an already-provisioned sandbox group via an existing-resource reference while carrying over identity configuration used for new (library-managed) sandbox groups; enabling managed identity for a workload after switching the target sandbox group from new to existing.","solutions":["Remove the app identity configuration (WithAppIdentity/ConfigureAppIdentity) from compute resources when publishing to an existing sandbox group.","Publish to a new (library-created) sandbox group if the workloads require managed identities.","Assign the required managed identity to the existing sandbox group manually outside of Aspire and reference it only in application code, not via the publish model."],"exampleFix":"// before (existing sandbox group)\nvar sandbox = sandboxGroupResource.PublishAsAzureSandbox(...);\ncompute.ConfigureAppIdentity(new AppIdentityAnnotation(uami));\n\n// after\nvar sandbox = sandboxGroupResource.PublishAsAzureSandbox(...); // no WithAppIdentity on compute\n// or: target a new sandbox group instead of the existing one","handlingStrategy":"validation","validationCode":"if (sandboxGroup.IsExisting() && computeResource.HasAnnotationOfType<AppIdentityAnnotation>())\n{\n    throw new InvalidOperationException(\"Workload identities are not supported for existing sandbox groups; remove WithAppIdentity or target a new sandbox group.\");\n}","typeGuard":"bool IsExistingSandbox(AzureSandboxGroupResource g) => g.IsExisting();","tryCatchPattern":"try { publish(); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"workload identities are not supported when publishing to existing\")) { /* strip app identity or publish to a new sandbox group */ }","preventionTips":["Decide up front: existing sandbox group => no managed workload identities via Aspire.","Keep app identity configuration only in code paths that create new sandbox groups.","Document the existing-group limitation for your team in deployment docs."],"tags":["azure","sandbox-group","managed-identity","existing-resource","publish"],"backgroundTag":"unsupported-operation","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}