microsoft/aspire · error · NotSupportedException

Compute resource ' ' uses an application identity type that…

Error message

Compute resource '{resource.Name}' uses an application identity type that Azure sandboxes do not support.

What it means

Azure sandbox groups support only user-assigned managed identities as compute-resource application identities. If a compute resource's AppIdentityAnnotation carries any other identity type (e.g. a different managed identity abstraction or an unsupported identity resource), the library cannot map it to a sandbox workload identity and throws NotSupportedException during publish.

Solutions

Change the compute resource's app identity to an AzureUserAssignedIdentityResource (user-assigned managed identity).
Remove any identity type that is not user-assigned from ConfigureAppIdentity/WithAppIdentity for sandbox-deployed resources.
If the resource intentionally targets a different compute environment, exclude it from the sandbox group or set an explicit compute environment for it.

Example fix

// before
computeResource.ConfigureAppIdentity(new AppIdentityAnnotation(systemAssignedIdentity));

// after
var uami = builder.AddUserAssignedIdentity("workload-mi");
computeResource.ConfigureAppIdentity(new AppIdentityAnnotation(uami));

Defensive patterns

Strategy: type-guard

Validate before calling

if (appIdentity?.IdentityResource is not AzureUserAssignedIdentityResource)
{
    throw new InvalidOperationException("Sandbox workloads require a user-assigned managed identity.");
}

Type guard

bool IsSandboxCompatibleIdentity(AppIdentityAnnotation a) => a.IdentityResource is AzureUserAssignedIdentityResource;

Try / catch

try { publish(); } catch (NotSupportedException ex) when (ex.Message.Contains("application identity type that Azure sandboxes do not support")) { /* switch the compute resource to a user-assigned identity */ }

Prevention

Always use AddUserAssignedIdentity-based app identities for sandbox-deployed compute resources.
Do not copy identity configuration from App Service/Container Apps examples into sandbox deployments.
Centralize identity creation in one helper that returns AzureUserAssignedIdentityResource only.

When it happens

Trigger: Publishing a compute resource into an Azure sandbox group where ConfigureAppIdentity/WithAppIdentity was given an identity resource that is not an AzureUserAssignedIdentityResource — for example a system-assigned identity representation or an Azure Compute Grove/other environment's identity type.

Common situations: Copying configuration used for Azure App Service/Container Apps (which accept other identity types) to a sandbox-targeted resource; using an API that produces a non-user-assigned identity resource; a refactor changing which identity resource type is passed to the compute resource.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/d1e15853bc769697. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs:235

            {
                continue;
            }

            if (resourceComputeEnvironment is not null && resourceComputeEnvironment != this)
            {
                continue;
            }

            if (resource.GetDeploymentTargetAnnotation(this) is not null)
            {
                continue;
            }

            if (resource.TryGetLastAnnotation<AppIdentityAnnotation>(out var appIdentity))
            {
                if (appIdentity.IdentityResource is not AzureUserAssignedIdentityResource userAssignedIdentity)
                {
                    throw new NotSupportedException(
                        $"Compute resource '{resource.Name}' uses an application identity type that Azure sandboxes do not support.");
                }

                if (this.IsExisting())
                {
                    throw new InvalidOperationException(
                        $"Compute resource '{resource.Name}' uses managed identity '{userAssignedIdentity.Name}', but workload identities are not supported when publishing to existing Azure sandbox group '{Name}'.");
                }

                if (ReferenceEquals(imagePullIdentity, userAssignedIdentity))
                {
                    throw new InvalidOperationException(
                        $"Azure sandbox group '{Name}' uses identity '{userAssignedIdentity.Name}' for both image pulls and workload '{resource.Name}'. " +
                        "Use a dedicated image-pull identity so its AcrPull permission is not exposed to sandbox workloads.");
                }

                AddWorkloadUserAssignedIdentity(userAssignedIdentity);
            }

View on GitHub (pinned to 25830f84bd)