microsoft/aspire · error · NotSupportedException

Automatic Key vault generation is not supported in this…

Error message

Automatic Key vault generation is not supported in this environment. Please create a key vault resource directly.

What it means

BaseContainerAppContext.ProcessValue throws this when a BicepSecretOutputReference (an obsolete type tied to automatic Key Vault generation) is used as a container app value. Aspire no longer auto-creates Key Vaults in this path; you must declare a Key Vault resource explicitly and reference its secrets. The type is marked [Obsolete] precisely because this path is unsupported.

Solutions

Add an explicit AddAzureKeyVault resource and reference its secrets via IAzureKeyVaultSecretReference instead.
Replace the BicepSecretOutputReference with a plain string or environment-provided secret value.
Migrate off the obsolete automatic Key Vault generation APIs in the app model.

Example fix

// before
.WithEnvironment("CONN_SECRET", bicepSecretOutputReference);

// after
var kv = builder.AddAzureKeyVault("kv");
.WithEnvironment("CONN_SECRET", kv.GetSecret("conn-string"));

Defensive patterns

Strategy: validation

Validate before calling

if (value is BicepSecretOutputReference)
    throw new InvalidOperationException("Use an explicit AddAzureKeyVault resource and its GetSecret instead.");

Type guard

bool IsObsoleteSecretRef(object? v) => v is BicepSecretOutputReference; // reject before publishing

Try / catch

try { /* build/publish */ } catch (NotSupportedException ex) when (ex.Message.Contains("Automatic Key vault generation")) { /* migrate to explicit Key Vault resource */ }

Prevention

Never use BicepSecretOutputReference; it is obsolete and unsupported.
Declare Key Vaults with AddAzureKeyVault and reference secrets via GetSecret.
Enable obsolete-warning (CS0618) as error to catch legacy APIs at compile time.

When it happens

Trigger: Passing a BicepSecretOutputReference (from the deprecated automatic Key Vault generation APIs) into WithEnvironment/WithArgs/WithEntrypoint on a container app or project resource.

Common situations: Older app models written before the automatic-keyvault-generation APIs were obsoleted being published to Container Apps; samples/code copied from pre-obsolescence documentation.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/3d9722e55da28be8. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.AppContainers/BaseContainerAppContext.cs:270

        if (value is ConnectionStringReference cs)
        {
            return ProcessValue(cs.Resource.ConnectionStringExpression, secretType: secretType, parent: parent);
        }

        if (value is IResourceWithConnectionString csrs)
        {
            return ProcessValue(csrs.ConnectionStringExpression, secretType: secretType, parent: parent);
        }

        if (value is BicepOutputReference output)
        {
            return (AllocateParameter(output, secretType: secretType), secretType);
        }

#pragma warning disable CS0618 // Type or member is obsolete
        if (value is BicepSecretOutputReference)
        {
            throw new NotSupportedException("Automatic Key vault generation is not supported in this environment. Please create a key vault resource directly.");
        }
#pragma warning restore CS0618 // Type or member is obsolete

        if (value is IAzureKeyVaultSecretReference vaultSecretReference)
        {
            if (parent is null)
            {
                return (AllocateKeyVaultSecretUriReference(vaultSecretReference), SecretType.KeyVault);
            }

            return (AllocateParameter(vaultSecretReference, secretType: SecretType.KeyVault), SecretType.KeyVault);
        }

        if (value is EndpointReferenceExpression epExpr)
        {
            if (ComputeEnvironmentEndpointResolver.TryGetCrossEnvironmentEndpointExpression(
                epExpr, [_containerAppEnvironmentContext.Environment], out var crossExpr))
            {

View on GitHub (pinned to 25830f84bd)