Bringing up Container Apps environment in our VNET fails (IaC Pulumi)

Question

Bringing up Container Apps environment in our VNET fails (IaC Pulumi)

August 5

We want to bring up Container Apps environment in our VNET. This doesn't work and it keeps on timing out. We're using Pulumi as our IaC tool. We want to bring up this environment in a private subnet which is currently not working. We need help with debugging our Environment deployment to understand why it isn't working.

Ranashekar Guda 1,260 Reputation points Microsoft External Staff

2025-03-19T12:21:13.2033333+00:00

Hi @August,

Thanks for reaching out. To debug the deployment of your Azure Container Apps environment in a private subnet using Pulumi, ensure that the subnet you are trying to use has the correct CIDR range. For a Workload profiles environment, the minimum required subnet size is /27, and for a Consumption-only environment, it is /23. If the subnet is smaller than these sizes, it may cause deployment issues. Ensure the subnet is delegated to Microsoft.App/environments and verify that your Pulumi configuration matches the resource group and location of the virtual network and subnet. If deployment is timing out, review timeout settings in your configuration.

For further clarification, please refer to the following documentations: Document1, Document2

I hope this helps resolve your issue. Feel free to reach out if you have further concerns.
Ranashekar Guda 1,260 Reputation points Microsoft External Staff

2025-03-20T14:03:36.5733333+00:00

Hi @August,

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
August 5 Reputation points

2025-03-20T15:15:53.3866667+00:00
Hi Ramesh,

Thanks for the quick response. We wanted to setup a Consumption-only environment. The size of the subnet where we want to deploy the container apps environment is actually /20. We tried delegating the subnet to Microsoft.App/environments but when we try to deploy our environment to this subnet we get the following error :

Status=200 Code="ManagedEnvironmentSubnetIsDelegated" Message="AgentPoolProfile subnet with id /subscriptions/16649620-bf97-436e-a745-994d99613e98/resourceGroups/atira-network-dev-rg408893b5/providers/Microsoft.Network/virtualNetworks/atira-network-dev-vnet520ac5c3/subnets/atira-network-dev-private-subnet cannot be used as it's a delegated subnet. Please check

(Please check https://aka.ms/adv-network-prerequest for more details.)

We have removed all NSG from our network setup so in theory we only have the default security rules active on all of our subnets.
You mentioned that:

...and verify that your Pulumi configuration matches the resource group and location of the virtual network and subnet.

Does this mean that the environment needs to be in the same resource group as the network? Because we are currently deploying the network and the container apps environment in separate resource groups. We don't have any timeout set for our Pulumi configuration, the problem is that the environment is not deployed even after 60 mins.

We tried to provision the environment via the Portal but it defaults to a Workload profiles environment which is not what we want. Is there something we need to do to deploy a Consumer-only environment?

Let me know if you need more details about our setup.
Ranashekar Guda 1,260 Reputation points Microsoft External Staff

2025-03-21T11:19:23.4166667+00:00

Hi @August,
As per the details provided above as you are using the consumption plan with /20 but you need to get that increased to /23, you can also refer the Document and below screenshot for better understanding on this

Also, regarding the error that you have provided we suggest you create a new Subnet along with the NSG rules and route table and service endpoints after configuring this attach the newly created to the existing VNET it might works please try and please let us know if you have any further concerns.
Naveen 0 Reputation points Microsoft External Staff

2025-04-02T10:04:04.8433333+00:00

Hi @August, Does the suggested solution work for you? Feel free to reach out if you have any further questions!
August 5 Reputation points

2025-04-02T12:41:32.9333333+00:00

We got it to work but also had to fix a bunch of other things. Thanks for the help!

Your answer

Ranashekar Guda 1,260 Reputation points Microsoft External Staff

2025-03-19T12:21:13.2033333+00:00

Hi @August,

Thanks for reaching out. To debug the deployment of your Azure Container Apps environment in a private subnet using Pulumi, ensure that the subnet you are trying to use has the correct CIDR range. For a Workload profiles environment, the minimum required subnet size is /27, and for a Consumption-only environment, it is /23. If the subnet is smaller than these sizes, it may cause deployment issues. Ensure the subnet is delegated to Microsoft.App/environments and verify that your Pulumi configuration matches the resource group and location of the virtual network and subnet. If deployment is timing out, review timeout settings in your configuration.

For further clarification, please refer to the following documentations: Document1, Document2

I hope this helps resolve your issue. Feel free to reach out if you have further concerns.
Ranashekar Guda 1,260 Reputation points Microsoft External Staff

2025-03-20T14:03:36.5733333+00:00

Hi @August,

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
August 5 Reputation points

2025-03-20T15:15:53.3866667+00:00

Hi Ramesh,

Thanks for the quick response. We wanted to setup a Consumption-only environment. The size of the subnet where we want to deploy the container apps environment is actually /20. We tried delegating the subnet to Microsoft.App/environments but when we try to deploy our environment to this subnet we get the following error :

Status=200 Code="ManagedEnvironmentSubnetIsDelegated" Message="AgentPoolProfile subnet with id /subscriptions/16649620-bf97-436e-a745-994d99613e98/resourceGroups/atira-network-dev-rg408893b5/providers/Microsoft.Network/virtualNetworks/atira-network-dev-vnet520ac5c3/subnets/atira-network-dev-private-subnet cannot be used as it's a delegated subnet. Please check

(Please check https://aka.ms/adv-network-prerequest for more details.)

We have removed all NSG from our network setup so in theory we only have the default security rules active on all of our subnets.
You mentioned that:

...and verify that your Pulumi configuration matches the resource group and location of the virtual network and subnet.

Does this mean that the environment needs to be in the same resource group as the network? Because we are currently deploying the network and the container apps environment in separate resource groups. We don't have any timeout set for our Pulumi configuration, the problem is that the environment is not deployed even after 60 mins.

We tried to provision the environment via the Portal but it defaults to a Workload profiles environment which is not what we want. Is there something we need to do to deploy a Consumer-only environment?

Let me know if you need more details about our setup.
Ranashekar Guda 1,260 Reputation points Microsoft External Staff

2025-03-21T11:19:23.4166667+00:00

Hi @August,
As per the details provided above as you are using the consumption plan with /20 but you need to get that increased to /23, you can also refer the Document and below screenshot for better understanding on this

Also, regarding the error that you have provided we suggest you create a new Subnet along with the NSG rules and route table and service endpoints after configuring this attach the newly created to the existing VNET it might works please try and please let us know if you have any further concerns.
Naveen 0 Reputation points Microsoft External Staff

2025-04-02T10:04:04.8433333+00:00

Hi @August, Does the suggested solution work for you? Feel free to reach out if you have any further questions!
August 5 Reputation points

2025-04-02T12:41:32.9333333+00:00

We got it to work but also had to fix a bunch of other things. Thanks for the help!

Share via

Bringing up Container Apps environment in our VNET fails (IaC Pulumi)

Your answer