Quickstart: Create a service connection in Azure Container Apps from the Azure portal

This quickstart shows you how to connect Azure Container Apps to other Cloud resources using the Azure portal and Service Connector. Service Connector lets you quickly connect compute services to cloud services, while managing your connection's authentication and networking settings.

Note

For information on connecting resources using Azure CLI, see Create a service connection in Container Apps with the Azure CLI.

Important

This feature in Container Apps is currently in preview. See the Supplemental Terms of Use for Microsoft Azure Previews for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

Prerequisites

• An Azure account with an active subscription. Create an account for free.
• An app deployed to Container Apps in a region supported by Service Connector.
• A target resource to connect your Container Apps to. For example, a storage account.

Sign in to Azure

Sign in to the Azure portal at https://portal.azure.com/ with your Azure account.

Create a new service connection

Use Service Connector to create a new service connection in Container Apps.

1. Select the Search resources, services and docs (G +/) search bar at the top of the Azure portal, type Container Apps in the filter and select Container Apps.

   

2. Select the name of the Container Apps resource you want to connect to a target resource.

3. Select Service Connector (preview) from the left table of contents. Then select Create.

   

4. Select or enter the following settings.

   Setting	Example	Description
   Container	my-container-app	The container of your container app.
   Service type	Storage - Blob	The type of service you're going to connect to your container.
   Subscription	my-subscription	The subscription that contains your target service (the service you want to connect to). The default value is the subscription that this container app is in.
   Connection name	storageblob_700ae	The connection name that identifies the connection between your container app and target service. Use the connection name provided by Service Connector or choose your own connection name.
   Storage account	my-storage-account	The target storage account you want to connect to. If you choose a different service type, select the corresponding target service instance.
   Client type	.NET	The application stack that works with the target service you selected. The default value is None, which generates a list of configurations. If you know about the app stack or the client SDK in the container you selected, select the same app stack for the client type.

5. Select Next: Authentication to choose an authentication method: system-assigned managed identity (SMI), user-assigned managed identity (UMI), connection string, or service principal.

   System-assigned managed identity (recommended)

   System-assigned managed identity is the recommended authentication option. Select System-assigned managed identity to connect through an identity that's automatically generated in Microsoft Entra ID and tied to the lifecycle of the service instance.

   User-assigned managed identity

   Select User-assigned managed identity to authenticate through a standalone identity assigned to one or more instances of an Azure service. Select a subscription that contains a user-assigned managed identity, and select the identity.

   If you don't have one yet, create a user-assigned managed identity:

   1. Open the Azure platform in a new tab and search for Managed identities.
   2. Select Managed identities and select Create
   3. Enter a subscription, resource group, region and instance name
   4. Select Review + create and the Create
   5. Once your managed identity has been deployed, go to your Service Connector tab, select Previous and then Next to refresh the form's data, and under User-assigned managed identity, select the identity you created.

   For more information, go to create a user-assigned managed identity.

   Service principal

   1. Select Service principal to use a service principal that defines the access policy and permissions for the user/application in Microsoft Entra ID.
   2. Select a service principal from the list and enter a secret

   Connection string

   Warning

   Microsoft recommends that you use the most secure authentication flow available. The authentication flow described in this procedure requires a very high degree of trust in the application, and carries risks that are not present in other flows. You should only use this flow when other more secure flows, such as managed identities, aren't viable.

   Select Connection string to generate or configure one or multiple key-value pairs with pure secrets or tokens.

6. Select Next: Networking to select the network configuration and select Configure firewall rules to enable access to target service so that your container can reach the Blob Storage.

   

7. Select Next: Review + Create to review the provided information. Running the final validation takes a few seconds.

   

8. Select Create to create the service connection. The operation can take up to a minute to complete.

View service connections

1. Container Apps connections are displayed under Settings > Service Connector (preview). Select > to expand the list and see the properties required by your application.

2. Select your connection and then Validate to prompt Service Connector to check your connection.

3. Select Learn more to review the connection validation details.

   

Next steps

Check the guide below for more information about Service Connector:

Service Connector internals