microsoft/aspire · error · NotSupportedException

Endpoint ' ' on resource ' ' shares target port with…

Error message

Endpoint '{resolvedEndpoint.Endpoint.Name}' on resource '{resource.TargetResource.Name}' shares target port {resolvedTargetPort} with endpoint '{existingEndpoint.Name}' but configures a different anonymous-access policy. Azure sandbox ports support a single access policy per target port.

What it means

A sandbox target port carries a single anonymous-access policy. When two endpoints on the same target port both set Anonymous but with different boolean values, the merged ingress configuration would be ambiguous, so NotSupportedException is thrown.

Solutions

  1. Align the anonymous-access setting on both endpoints for the shared port
  2. Separate the endpoints onto different target ports
  3. Remove the duplicate endpoint configuration

Example fix

// before
.WithHttpEndpoint(targetPort: 8080) // anonymous: true via options
.WithEndpoint(..., targetPort: 8080) // anonymous: false
// after
.WithHttpEndpoint(targetPort: 8080)
.WithHttpEndpoint(targetPort: 8081) // different policy on its own port
Defensive patterns

Strategy: validation

Validate before calling

var byPort = resource.Endpoints.GroupBy(e => e.TargetPort)
    .Where(g => g.Select(e => e.Anonymous).Where(a => a is not null).Distinct().Count() > 1);
if (byPort.Any()) throw new InvalidOperationException("Shared target port with mixed anonymous policies.");

Try / catch

try { DeploySandbox(...); } catch (NotSupportedException ex) when (ex.Message.Contains("single access policy per target port")) { /* align Anonymous flags or split ports */ }

Prevention

When it happens

Trigger: Endpoints sharing resolvedTargetPort where existingEndpoint.Anonymous and endpoint.Anonymous are both non-null and unequal (one requires auth, the other allows anonymous).

Common situations: Mixing WithEndpoint options / sandbox endpoint options across endpoints on one port, e.g. one endpoint marked public-anonymous and another authenticated on the same port.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/644232c6a9dcb188. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs:1532

                resolvedEndpoint.Endpoint.Name,
                resolvedTargetPort,
                IsExternal: true,
                IsHttp: true,
                protocol,
                resolvedEndpointOptions?.Anonymous);

            if (endpoints.TryGetValue(resolvedTargetPort, out var existingEndpoint))
            {
                if (!string.Equals(existingEndpoint.Protocol, endpoint.Protocol, StringComparison.Ordinal))
                {
                    throw new NotSupportedException($"Endpoint '{resolvedEndpoint.Endpoint.Name}' on resource '{resource.TargetResource.Name}' shares target port {resolvedTargetPort} with endpoint '{existingEndpoint.Name}' but uses a different transport. Azure sandbox ports support a single HTTP protocol per target port.");
                }

                if (existingEndpoint.Anonymous is not null &&
                    endpoint.Anonymous is not null &&
                    existingEndpoint.Anonymous != endpoint.Anonymous)
                {
                    throw new NotSupportedException($"Endpoint '{resolvedEndpoint.Endpoint.Name}' on resource '{resource.TargetResource.Name}' shares target port {resolvedTargetPort} with endpoint '{existingEndpoint.Name}' but configures a different anonymous-access policy. Azure sandbox ports support a single access policy per target port.");
                }

                endpoints[resolvedTargetPort] = existingEndpoint with
                {
                    IsExternal = existingEndpoint.IsExternal || endpoint.IsExternal,
                    IsHttp = existingEndpoint.IsHttp || endpoint.IsHttp,
                    Anonymous = existingEndpoint.Anonymous ?? endpoint.Anonymous
                };
            }
            else
            {
                endpoints.Add(resolvedTargetPort, endpoint);
            }
        }

        if (unmatchedEndpointOptions is { Count: > 0 })
        {
            throw new InvalidOperationException($"Resource '{resource.TargetResource.Name}' has Azure sandbox endpoint options for endpoint(s) that are not exposed by EndpointAnnotation: {string.Join(", ", unmatchedEndpointOptions)}.");

View on GitHub (pinned to 25830f84bd)