{"record":{"id":"d1e15853bc769697","repo":"microsoft/aspire","slug":"compute-resource-resource-name-uses-an-application-identity","errorCode":null,"errorMessage":"Compute resource '{resource.Name}' uses an application identity type that Azure sandboxes do not support.","messagePattern":"Compute resource '(.+?)' uses an application identity type that Azure sandboxes do not support\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs","lineNumber":235,"sourceCode":"            {\n                continue;\n            }\n\n            if (resourceComputeEnvironment is not null && resourceComputeEnvironment != this)\n            {\n                continue;\n            }\n\n            if (resource.GetDeploymentTargetAnnotation(this) is not null)\n            {\n                continue;\n            }\n\n            if (resource.TryGetLastAnnotation<AppIdentityAnnotation>(out var appIdentity))\n            {\n                if (appIdentity.IdentityResource is not AzureUserAssignedIdentityResource userAssignedIdentity)\n                {\n                    throw new NotSupportedException(\n                        $\"Compute resource '{resource.Name}' uses an application identity type that Azure sandboxes do not support.\");\n                }\n\n                if (this.IsExisting())\n                {\n                    throw new InvalidOperationException(\n                        $\"Compute resource '{resource.Name}' uses managed identity '{userAssignedIdentity.Name}', but workload identities are not supported when publishing to existing Azure sandbox group '{Name}'.\");\n                }\n\n                if (ReferenceEquals(imagePullIdentity, userAssignedIdentity))\n                {\n                    throw new InvalidOperationException(\n                        $\"Azure sandbox group '{Name}' uses identity '{userAssignedIdentity.Name}' for both image pulls and workload '{resource.Name}'. \" +\n                        \"Use a dedicated image-pull identity so its AcrPull permission is not exposed to sandbox workloads.\");\n                }\n\n                AddWorkloadUserAssignedIdentity(userAssignedIdentity);\n            }","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs#L217-L253","documentation":"Azure sandbox groups support only user-assigned managed identities as compute-resource application identities. If a compute resource's AppIdentityAnnotation carries any other identity type (e.g. a different managed identity abstraction or an unsupported identity resource), the library cannot map it to a sandbox workload identity and throws NotSupportedException during publish.","triggerScenarios":"Publishing a compute resource into an Azure sandbox group where ConfigureAppIdentity/WithAppIdentity was given an identity resource that is not an AzureUserAssignedIdentityResource — for example a system-assigned identity representation or an Azure Compute Grove/other environment's identity type.","commonSituations":"Copying configuration used for Azure App Service/Container Apps (which accept other identity types) to a sandbox-targeted resource; using an API that produces a non-user-assigned identity resource; a refactor changing which identity resource type is passed to the compute resource.","solutions":["Change the compute resource's app identity to an AzureUserAssignedIdentityResource (user-assigned managed identity).","Remove any identity type that is not user-assigned from ConfigureAppIdentity/WithAppIdentity for sandbox-deployed resources.","If the resource intentionally targets a different compute environment, exclude it from the sandbox group or set an explicit compute environment for it."],"exampleFix":"// before\ncomputeResource.ConfigureAppIdentity(new AppIdentityAnnotation(systemAssignedIdentity));\n\n// after\nvar uami = builder.AddUserAssignedIdentity(\"workload-mi\");\ncomputeResource.ConfigureAppIdentity(new AppIdentityAnnotation(uami));","handlingStrategy":"type-guard","validationCode":"if (appIdentity?.IdentityResource is not AzureUserAssignedIdentityResource)\n{\n    throw new InvalidOperationException(\"Sandbox workloads require a user-assigned managed identity.\");\n}","typeGuard":"bool IsSandboxCompatibleIdentity(AppIdentityAnnotation a) => a.IdentityResource is AzureUserAssignedIdentityResource;","tryCatchPattern":"try { publish(); } catch (NotSupportedException ex) when (ex.Message.Contains(\"application identity type that Azure sandboxes do not support\")) { /* switch the compute resource to a user-assigned identity */ }","preventionTips":["Always use AddUserAssignedIdentity-based app identities for sandbox-deployed compute resources.","Do not copy identity configuration from App Service/Container Apps examples into sandbox deployments.","Centralize identity creation in one helper that returns AzureUserAssignedIdentityResource only."],"tags":["azure","sandbox-group","managed-identity","unsupported-operation","publish"],"backgroundTag":"unsupported-operation","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}