microsoft/aspire · error · InvalidOperationException

Resource ' ' is configured to publish as an Azure sandbox…

Error message

Resource '{resource.Name}' is configured to publish as an Azure sandbox, but there are no 'AzureSandboxGroupResource' resources. Ensure you have added one by calling 'AddAzureSandboxGroup'.

What it means

During publish, EnsureSandboxPublisherValidationAdded verifies that a resource marked with PublishAsAzureSandbox actually has at least one AzureSandboxGroupResource in the application model. Sandbox publishing requires sandbox groups to host resources; with none defined, the publish model is incomplete and an InvalidOperationException is thrown.

Solutions

Add a sandbox group in the AppHost: builder.AddAzureSandboxGroup("group-name")
Ensure the AddAzureSandboxGroup call is not behind a condition that is skipped at publish time
Remove PublishAsAzureSandbox if sandbox publishing was not intended

Example fix

// before
builder.AddProject<Projects.Frontend>("frontend").PublishAsAzureSandbox();
// after
var group = builder.AddAzureSandboxGroup("sandbox-group");
builder.AddProject<Projects.Frontend>("frontend").PublishAsAzureSandbox().WithComputeEnvironment(group);

Defensive patterns

Strategy: validation

Validate before calling

// in AppHost, before building
var hasGroups = ((IDistributedApplicationBuilder)builder).Resources.OfType<AzureSandboxGroupResource>().Any();
if (!hasGroups) throw new InvalidOperationException("PublishAsAzureSandbox requires AddAzureSandboxGroup");

Try / catch

try { app.Run(); } catch (InvalidOperationException ex) when (ex.Message.Contains("AddAzureSandboxGroup")) { /* add sandbox group and re-run */ }

Prevention

Pair every PublishAsAzureSandbox call with AddAzureSandboxGroup in the same AppHost
Check conditional code paths that may skip group creation
Grep the AppHost for AddAzureSandboxGroup when adopting sandbox publishing

When it happens

Trigger: Calling resource.PublishAsAzureSandbox() but never calling AddAzureSandboxGroup anywhere in the AppHost, then running publish/start; all sandbox groups removed or filtered out so sandboxGroups.Count == 0 at validation time.

Common situations: Adding the PublishAsAzureSandbox call from a sample without the accompanying AddAzureSandboxGroup step; conditional code paths that add sandbox groups not taken at runtime; refactoring that deleted the group definition while leaving the publisher annotation.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/3b0f19ba15e4b4cc. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs:481

                {
                    return Task.CompletedTask;
                }

                var sandboxGroups = context.Model.Resources
                    .OfType<AzureSandboxGroupResource>()
                    .Where(static group => !group.IsExcludedFromPublish())
                    .ToHashSet();

                foreach (var resource in context.Model.GetComputeResources())
                {
                    if (!resource.HasAnnotationOfType<AzureSandboxContainerOptionsAnnotation>())
                    {
                        continue;
                    }

                    if (sandboxGroups.Count == 0)
                    {
                        throw new InvalidOperationException(
                            $"Resource '{resource.Name}' is configured to publish as an Azure sandbox, but there are no '{nameof(AzureSandboxGroupResource)}' resources. " +
                            $"Ensure you have added one by calling '{nameof(AddAzureSandboxGroup)}'.");
                    }

                    var computeEnvironment = resource.GetComputeEnvironment();
                    if (computeEnvironment is not null &&
                        (computeEnvironment is not AzureSandboxGroupResource sandboxGroup ||
                         !sandboxGroups.Contains(sandboxGroup)))
                    {
                        throw new InvalidOperationException(
                            $"Resource '{resource.Name}' is configured to publish as an Azure sandbox, but it is assigned to compute environment '{computeEnvironment.Name}', which is not an active Azure sandbox group. " +
                            $"Assign it to an '{nameof(AzureSandboxGroupResource)}' by calling 'WithComputeEnvironment'.");
                    }
                }

                return Task.CompletedTask;
            },
            dependsOn: WellKnownPipelineSteps.ValidateComputeEnvironments,

View on GitHub (pinned to 25830f84bd)