Container Environment type: Consumption only and Workload profile

Question

In this article: https://learn.microsoft.com/en-us/azure/container-apps/environment (dated 05/02/2025), I saw that Azure Container Apps (ACA) offers two separate environment workload types:

Consumption only

Workload profile

Each type has a different way of controlling network access with a Network Security Group (NSG): https://learn.microsoft.com/en-us/azure/container-apps/firewall-integration?tabs=workload-profiles#nsg-allow-rules

However, I can no longer create a new ACA environment using the Consumption only type. It always shows a result like in the image, even when I leave everything as default.

I would like to understand how to apply NSG rules to an ACA environment when the default type appears to be Workload profile (as shown in the properties).

Answer 1

Hello Đỗ Hoàng Minh Hưng,

As of May 2025, Microsoft removed the "Consumption-only" (v1) environment option from the Azure Portal UI. Now, every new ACA environment created via the portal defaults to the "Workload Profiles" (v2) model and includes a Consumption profile by default (screenshot 1 confirms this behavior).

This is by design and is documented here: Environment types in ACA

How to Restrict Access Using NSG with Workload Profiles?

Ans- You're still fully able to control public traffic using NSG rules, even under the newer Workload Profiles environment.

I tested this exact scenario by creating a VNet-injected ACA environment with a public endpoint. Deployed a container app to it. Applied NSG rules to the subnet. Allow only my own IP on ports 80/443. Deny all others

Result: Access from other IPs was blocked successfully even though the app was public. This behavior is confirmed by Microsoft here: Firewall integration via NSG (Workload Profiles)

So even though your ACA is public (as shown in your screenshot), the NSG on the subnet still controls access effectively.

Want to Use Legacy "Consumption-only" (v1) Environment?
Ans- You won’t find it in the Portal anymore, but you can still create it using Azure CLI.

az containerapp env create \
  --name aca-env-consumption-v1 \
  --resource-group arkorg \
  --location eastus \
  --infrastructure-subnet-resource-id <subnet-id-for-/23-subnet> \
  --enable-workload-profiles false

Note- You must use a subnet with at least a /23 address range for v1 to work.

Answer 2

Hi,

What you are seeing is expected.

The default now is to create a Workload profiles (v2) environment, which includes a Consumption profile by default. This gives you the flexibility of the older Consumption-only (v1) with the benefit of being able to add Dedicated profile in the future (if you need it).

Please see two articles below for more information and FAQ:

Compute and billing structures in Azure Container Apps

https://learn.microsoft.com/en-us/azure/container-apps/structure

Consumption-only environment type in Azure Container Apps

https://learn.microsoft.com/en-us/azure/container-apps/environment-type-consumption-only

In regards to networking/NSG, that will depend on if you choose to integrate with your own VNet when you create the Container App/environment. If you choose to integrate with VNet you will have ability to configure NSG rules as described in the article you referenced.

Please note if you choose to integrate with your own VNet there will be an additional resource group created with infrastructure resources (e.g. load balancer, public IP) that will incur separate costs.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP