microsoft/aspire · error · InvalidOperationException

Compute resource ' ' uses managed identity ' ', but…

Error message

Compute resource '{resource.Name}' uses managed identity '{userAssignedIdentity.Name}', but workload identities are not supported when publishing to existing Azure sandbox group '{Name}'.

What it means

When publishing to an existing (pre-created) Azure sandbox group, the library does not manage the group, so it cannot create or assign workload user-assigned identities. A compute resource with an AppIdentityAnnotation targeting an existing sandbox group is therefore rejected.

Solutions

Remove the app identity configuration (WithAppIdentity/ConfigureAppIdentity) from compute resources when publishing to an existing sandbox group.
Publish to a new (library-created) sandbox group if the workloads require managed identities.
Assign the required managed identity to the existing sandbox group manually outside of Aspire and reference it only in application code, not via the publish model.

Example fix

// before (existing sandbox group)
var sandbox = sandboxGroupResource.PublishAsAzureSandbox(...);
compute.ConfigureAppIdentity(new AppIdentityAnnotation(uami));

// after
var sandbox = sandboxGroupResource.PublishAsAzureSandbox(...); // no WithAppIdentity on compute
// or: target a new sandbox group instead of the existing one

Defensive patterns

Strategy: validation

Validate before calling

if (sandboxGroup.IsExisting() && computeResource.HasAnnotationOfType<AppIdentityAnnotation>())
{
    throw new InvalidOperationException("Workload identities are not supported for existing sandbox groups; remove WithAppIdentity or target a new sandbox group.");
}

Type guard

bool IsExistingSandbox(AzureSandboxGroupResource g) => g.IsExisting();

Try / catch

try { publish(); } catch (InvalidOperationException ex) when (ex.Message.Contains("workload identities are not supported when publishing to existing")) { /* strip app identity or publish to a new sandbox group */ }

Prevention

Decide up front: existing sandbox group => no managed workload identities via Aspire.
Keep app identity configuration only in code paths that create new sandbox groups.
Document the existing-group limitation for your team in deployment docs.

When it happens

Trigger: Calling PublishAsAzureSandbox / pointing a compute resource at a sandbox group created as existing (IsExisting() is true) while that compute resource has ConfigureAppIdentity/WithAppIdentity applied with an AzureUserAssignedIdentityResource.

Common situations: Pointing an app at an already-provisioned sandbox group via an existing-resource reference while carrying over identity configuration used for new (library-managed) sandbox groups; enabling managed identity for a workload after switching the target sandbox group from new to existing.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/d0dc5cfa7cd92897. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs:241

                continue;
            }

            if (resource.GetDeploymentTargetAnnotation(this) is not null)
            {
                continue;
            }

            if (resource.TryGetLastAnnotation<AppIdentityAnnotation>(out var appIdentity))
            {
                if (appIdentity.IdentityResource is not AzureUserAssignedIdentityResource userAssignedIdentity)
                {
                    throw new NotSupportedException(
                        $"Compute resource '{resource.Name}' uses an application identity type that Azure sandboxes do not support.");
                }

                if (this.IsExisting())
                {
                    throw new InvalidOperationException(
                        $"Compute resource '{resource.Name}' uses managed identity '{userAssignedIdentity.Name}', but workload identities are not supported when publishing to existing Azure sandbox group '{Name}'.");
                }

                if (ReferenceEquals(imagePullIdentity, userAssignedIdentity))
                {
                    throw new InvalidOperationException(
                        $"Azure sandbox group '{Name}' uses identity '{userAssignedIdentity.Name}' for both image pulls and workload '{resource.Name}'. " +
                        "Use a dedicated image-pull identity so its AcrPull permission is not exposed to sandbox workloads.");
                }

                AddWorkloadUserAssignedIdentity(userAssignedIdentity);
            }

            AzureSandboxContainerDeployment.ValidateSandboxCompatibility(resource);

            resource.Annotations.Add(new ContainerBuildOptionsCallbackAnnotation(static buildOptions =>
            {
                // ADC requires a single Docker-format linux/amd64 manifest. Buildx's default OCI

View on GitHub (pinned to 25830f84bd)