Could not resolve the Azure subscription selected for…

Error message

Could not resolve the Azure subscription selected for deployment. Ensure Azure provisioning has completed, or set the Azure:SubscriptionId configuration value.

What it means

During AKS deployment-scope resolution, the pipeline needs a subscription ID to run az commands (get-credentials / list resource groups). It takes the value from the pipeline argument if pinned, otherwise falls back to the persisted global Azure deployment state. If both are empty, the Azure environment has never been provisioned (so no subscription was persisted) and no Azure:SubscriptionId config was supplied, so Aspire cannot determine which subscription to operate against.

Solutions

Set the Azure:SubscriptionId configuration value (config file, environment variable Azure__SubscriptionId, or pipeline parameter) to the subscription hosting the AKS cluster.
Run `aspire deploy` (Azure provisioning) first so the subscription is persisted in deployment state before running AKS credential acquisition or destroy.
Verify the deployment state store (Azure:Deployments section) exists and was not deleted between runs.
If running destroy on a never-deployed environment, supply the subscription explicitly since no state exists to fall back on.

Example fix

// before (no subscription anywhere)
aspire deploy

// after
aspire deploy --subscription 00000000-0000-0000-0000-000000000000
// or config:
// { "Azure": { "SubscriptionId": "00000000-0000-0000-0000-000000000000" } }

Defensive patterns

Strategy: validation

Validate before calling

var subId = config["Azure:SubscriptionId"];
if (string.IsNullOrWhiteSpace(subId))
    throw new InvalidOperationException("Set Azure:SubscriptionId or run aspire deploy first so provisioning state is persisted.");

Prevention

Always set Azure:SubscriptionId in CI/headless environments
Run aspire deploy before any destroy or credential-consuming operation
Never delete the deployment state store between related commands

When it happens

Trigger: Running `aspire deploy`/`destroy` for an AzureKubernetesEnvironmentResource when: (1) Azure provisioning has not completed (no persisted deployment state at Azure:Deployments:...), (2) globalSubscriptionId is empty because the AzureEnvironmentResource step was skipped or state was cleared, and (3) no 'Azure:SubscriptionId' configuration value was provided.

Common situations: Fresh CI environment with no prior deploy state; user deleted or reset the deployment state store; running destroy against an environment never deployed with this pipeline; forgetting to pass --subscription or the Azure:SubscriptionId config key in headless/CI runs.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/29464dab53d86089. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs:849

        var resourceGroup = await ResolveScopeValueAsync(scopedResourceGroup, cancellationToken).ConfigureAwait(false);

        // Fully pinned by the resource, so the global deployment state is irrelevant and must not be
        // required. This matters because the app's own subscription may legitimately be absent when
        // every Azure resource is an adopted existing one.
        if (!string.IsNullOrEmpty(subscriptionId) && !string.IsNullOrEmpty(resourceGroup))
        {
            return (subscriptionId, resourceGroup);
        }

        var (globalSubscriptionId, globalResourceGroup) =
            await TryGetAzureDeploymentStateAsync(services, cancellationToken).ConfigureAwait(false);

        var pinnedSubscription = !string.IsNullOrEmpty(subscriptionId);
        subscriptionId = pinnedSubscription ? subscriptionId : globalSubscriptionId;

        if (string.IsNullOrEmpty(subscriptionId))
        {
            throw new InvalidOperationException(
                "Could not resolve the Azure subscription selected for deployment. " +
                "Ensure Azure provisioning has completed, or set the Azure:SubscriptionId configuration value.");
        }

        if (string.IsNullOrEmpty(resourceGroup))
        {
            // The saved resource group only names a group inside the saved subscription. Inheriting it
            // across a subscription boundary would point at a group that may not exist there, or worse
            // at an unrelated group that happens to share the name, so force discovery instead.
            resourceGroup = pinnedSubscription && !string.Equals(subscriptionId, globalSubscriptionId, StringComparison.OrdinalIgnoreCase)
                ? null
                : globalResourceGroup;
        }

        return (subscriptionId, resourceGroup);
    }

    /// <summary>

View on GitHub (pinned to 25830f84bd)