microsoft/aspire · error

The Azure deployment state for AKS environment

Error message

The Azure deployment state for AKS environment '{Name}' contains an invalid scope.

What it means

Wrapper thrown when reading or parsing the persisted scope from the AKS deployment state throws any non-cancellation exception. The original exception (e.g. missing Scope key, invalid JSON, wrong value kind) is preserved as InnerException.

Solutions

1. Read the InnerException to identify the root cause (missing key vs malformed JSON)
2. Re-deploy the AKS environment to regenerate a valid deployment state including the Scope output
3. Validate the state file's Scope entry is a JSON object with 'subscription' and 'resourceGroup' string properties
4. Delete the stale deployment state and let the pipeline recreate it

Example fix

// diagnose with:
// catch (InvalidOperationException ex)
// {
//     Console.WriteLine(ex.InnerException); // e.g. NullReferenceException on Scope
// }
// fix: redeploy so Scope is rewritten by BicepUtilities.SetScopeAsync

if (!state.Data.TryGetValue("Scope", out var scopeRaw) || string.IsNullOrWhiteSpace(scopeRaw))
    throw new InvalidOperationException("Scope missing or empty in deployment state.");

try
{
    /* read/parse scope */
}
catch (InvalidOperationException ex)
{
    // inspect ex.InnerException for the parse failure, then redeploy to regenerate state
}

When it happens

Trigger: GetAksCredentialsForDestroyAsync catches a failure while reading deploymentStateSection.Data["Scope"] or parsing it as a JSON object and rethrows with the environment name in the message.

Common situations: Scope output missing from deployment state (null-forgiving read throws), malformed JSON after manual edits, value is a JSON array/string instead of an object, state file from an older schema.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• The Azure deployment state for AKS environment
• The persisted scope is not a JSON object.
• No Azure deployment state was found for AKS environment
• The Azure deployment state for AKS environment
• az aks get-credentials failed

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/096023206b8f3662. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs:426

        // resource ID so a changed AppHost scope cannot redirect cleanup to another cluster or wait
        // on provisioning that is not part of the destroy graph.
        string subscriptionId;
        string? resourceGroupName;
        if (deploymentStateSection.Data["Scope"] is not null)
        {
            string? scopedSubscription;
            string? scopedResourceGroup;
            try
            {
                var scopeJson = deploymentStateSection.Data["Scope"]!.GetValue<string>();
                var scope = JsonNode.Parse(scopeJson)?.AsObject()
                    ?? throw new InvalidOperationException("The persisted scope is not a JSON object.");
                scopedSubscription = scope["subscription"]?.GetValue<string>();
                scopedResourceGroup = scope["resourceGroup"]?.GetValue<string>();
            }
            catch (Exception ex) when (ex is not OperationCanceledException)
            {
                throw new InvalidOperationException(
                    $"The Azure deployment state for AKS environment '{Name}' contains an invalid scope.",
                    ex);
            }

            (subscriptionId, resourceGroupName) = await ResolveDeploymentScopeAsync(
                scopedSubscription,
                scopedResourceGroup,
                context.Services,
                context.CancellationToken).ConfigureAwait(false);
        }
        else
        {
            subscriptionId = clusterResourceId.SubscriptionId!;
            resourceGroupName = clusterResourceId.ResourceGroupName!;
        }

        await GetAksCredentialsAsync(
            context,

View on GitHub (pinned to 25830f84bd)