microsoft/aspire · error · InvalidOperationException

Resource ' ' is configured to publish as an Azure sandbox…

Error message

Resource '{resource.Name}' is configured to publish as an Azure sandbox, but it is assigned to compute environment '{computeEnvironment.Name}', which is not an active Azure sandbox group. Assign it to an 'AzureSandboxGroupResource' by calling 'WithComputeEnvironment'.

What it means

A resource published with PublishAsAzureSandbox must be assigned to an AzureSandboxGroupResource that is part of the active sandbox groups. If the resource's compute environment is some other environment type, or a sandbox group not present in the current model, publish validation throws this InvalidOperationException and suggests assigning it with WithComputeEnvironment.

Solutions

Call WithComputeEnvironment with the AzureSandboxGroupResource returned by AddAzureSandboxGroup
Verify the referenced group is actually added in the AppHost (not conditionally skipped)
Remove the non-sandbox compute environment assignment that conflicts with sandbox publishing

Example fix

// before
var env = builder.AddAzureEnvironment("env");
builder.AddProject<Projects.Frontend>("frontend").PublishAsAzureSandbox().WithComputeEnvironment(env);
// after
var group = builder.AddAzureSandboxGroup("sandbox-group");
builder.AddProject<Projects.Frontend>("frontend").PublishAsAzureSandbox().WithComputeEnvironment(group);

Defensive patterns

Strategy: validation

Validate before calling

var env = resource.GetComputeEnvironment();
if (env is not null && env is not AzureSandboxGroupResource) throw new InvalidOperationException("Assign an AzureSandboxGroupResource via WithComputeEnvironment");

Try / catch

try { app.Run(); } catch (InvalidOperationException ex) when (ex.Message.Contains("WithComputeEnvironment")) { /* fix compute environment assignment */ }

Prevention

Always pass the AddAzureSandboxGroup return value to WithComputeEnvironment
Don't mix regular Azure compute environments with sandbox publishing on the same resource
Verify the referenced group exists unconditionally in the AppHost

When it happens

Trigger: resource.WithComputeEnvironment(environment) called with a non-sandbox compute environment (e.g. an Azure environment resource), or with a sandbox group that was not added/active in the model, while PublishAsAzureSandbox is applied to the resource.

Common situations: Mixing sandbox publishing with a regular Azure compute environment from another integration; pointing at a sandbox group defined in a different branch/condition so it is not in the active set; renaming or removing the group but leaving stale WithComputeEnvironment wiring.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/0bb1f790c1868017. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs:491

                {
                    if (!resource.HasAnnotationOfType<AzureSandboxContainerOptionsAnnotation>())
                    {
                        continue;
                    }

                    if (sandboxGroups.Count == 0)
                    {
                        throw new InvalidOperationException(
                            $"Resource '{resource.Name}' is configured to publish as an Azure sandbox, but there are no '{nameof(AzureSandboxGroupResource)}' resources. " +
                            $"Ensure you have added one by calling '{nameof(AddAzureSandboxGroup)}'.");
                    }

                    var computeEnvironment = resource.GetComputeEnvironment();
                    if (computeEnvironment is not null &&
                        (computeEnvironment is not AzureSandboxGroupResource sandboxGroup ||
                         !sandboxGroups.Contains(sandboxGroup)))
                    {
                        throw new InvalidOperationException(
                            $"Resource '{resource.Name}' is configured to publish as an Azure sandbox, but it is assigned to compute environment '{computeEnvironment.Name}', which is not an active Azure sandbox group. " +
                            $"Assign it to an '{nameof(AzureSandboxGroupResource)}' by calling 'WithComputeEnvironment'.");
                    }
                }

                return Task.CompletedTask;
            },
            dependsOn: WellKnownPipelineSteps.ValidateComputeEnvironments,
            requiredBy: WellKnownPipelineSteps.BeforeStart);
    }

    private static void ApplyManagedServiceIdentity(
        ManagedServiceIdentity identity,
        AzureSandboxGroupResource resource,
        BicepValue<string> imagePullIdentityId,
        AzureResourceInfrastructure infrastructure)
    {
        identity.ManagedServiceIdentityType = resource.WorkloadManagedIdentityType switch

View on GitHub (pinned to 25830f84bd)