Provide a virtual network to an external Azure Container Apps environment

The following example shows you how to create a Container Apps environment in an existing virtual network.

Begin by signing in to the Azure portal.

Create a container app

To create your container app, start at the Azure portal home page.

  1. Search for Container Apps in the top search bar.
  2. Select Container Apps in the search results.
  3. Select the Create button.

Basics tab

In the Basics tab, do the following actions.

  1. Enter the following values in the Project details section.

    Setting Action
    Subscription Select your Azure subscription.
    Resource group Select Create new and enter my-container-apps.
    Container app name Enter my-container-app.

Create an environment

Next, create an environment for your container app.

  1. Select the appropriate region.

    Setting Value
    Region Select Central US.
  2. In the Create Container Apps environment field, select the Create new link.

  3. In the Create Container Apps Environment page on the Basics tab, enter the following values:

    Setting Value
    Environment name Enter my-environment.
    Environment type Select Consumption only.
    Zone redundancy Select Disabled
  4. Select the Monitoring tab to create a Log Analytics workspace.

  5. Select Azure Log Analytics as the Logs Destination.

  6. Select the Create new link in the Log Analytics workspace field and enter the following values.

    Setting Value
    Name Enter my-container-apps-logs.

    The Location field is prefilled with Central US for you.

  7. Select OK.


You can use an existing virtual network, but a dedicated subnet with a CIDR range of /23 or larger is required for use with Container Apps when using the Consumption only Architecture. When using a workload profiles environment, a /27 or larger is required. To learn more about subnet sizing, see the networking architecture overview.

  1. Select the Networking tab to create a VNET.

  2. Select Yes next to Use your own virtual network.

  3. Next to the Virtual network box, select the Create new link and enter the following value.

    Setting Value
    Name Enter my-custom-vnet.
  4. Select the OK button.

  5. Next to the Infrastructure subnet box, select the Create new link and enter the following values:

    Setting Value
    Subnet Name Enter infrastructure-subnet.
    Virtual Network Address Block Keep the default values.
    Subnet Address Block Keep the default values.
  6. Select the OK button.

  7. Under Virtual IP, select External.

  8. Select Create.

Deploy the container app

  1. Select Review and create at the bottom of the page.

    If no errors are found, the Create button is enabled.

    If there are errors, any tab containing errors is marked with a red dot. Navigate to the appropriate tab. Fields containing an error are highlighted in red. Once all errors are fixed, select Review and create again.

  2. Select Create.

    A page with the message Deployment is in progress is displayed. Once the deployment is successfully completed, you see the message: Your deployment is complete.



To begin, sign in to Azure. Run the following command, and follow the prompts to complete the authentication process.

az login

Next, install the Azure Container Apps extension for the CLI.

az extension add --name containerapp --upgrade

Now that the current extension or module is installed, register the Microsoft.App namespace.


Azure Container Apps resources have migrated from the Microsoft.Web namespace to the Microsoft.App namespace. Refer to Namespace migration from Microsoft.Web to Microsoft.App in March 2022 for more details.

az provider register --namespace Microsoft.App

Register the Microsoft.OperationalInsights provider for the Azure Monitor Log Analytics workspace if you have not used it before.

az provider register --namespace Microsoft.OperationalInsights

Next, set the following environment variables:


With these variables defined, you can create a resource group to organize the services related to your new container app.

az group create \
  --name $RESOURCE_GROUP \
  --location $LOCATION

With the CLI upgraded and a new resource group available, you can create a Container Apps environment and deploy your container app.

Create an environment

An environment in Azure Container Apps creates a secure boundary around a group of container apps. Container Apps deployed to the same environment are deployed in the same virtual network and write logs to the same Log Analytics workspace.

Register the Microsoft.ContainerService provider.

az provider register --namespace Microsoft.ContainerService

Declare a variable to hold the VNET name.


Now create an Azure virtual network to associate with the Container Apps environment. The virtual network must have a subnet available for the environment deployment.


Network subnet address prefix requires a minimum CIDR range of /23 for use with Container Apps when using the Consumption only Architecture. When using the Workload Profiles Architecture, a /27 or larger is required. To learn more about subnet sizing, see the networking architecture overview.

az network vnet create \
  --resource-group $RESOURCE_GROUP \
  --name $VNET_NAME \
  --location $LOCATION \
az network vnet subnet create \
  --resource-group $RESOURCE_GROUP \
  --vnet-name $VNET_NAME \
  --name infrastructure-subnet \

With the virtual network created, you can retrieve the ID for the infrastructure subnet.

INFRASTRUCTURE_SUBNET=`az network vnet subnet show --resource-group ${RESOURCE_GROUP} --vnet-name $VNET_NAME --name infrastructure-subnet --query "id" -o tsv | tr -d '[:space:]'`

Finally, create the Container Apps environment using the custom VNET deployed in the preceding steps.

az containerapp env create \
  --resource-group $RESOURCE_GROUP \
  --location "$LOCATION" \
  --infrastructure-subnet-resource-id $INFRASTRUCTURE_SUBNET

The following table describes the parameters used in containerapp env create.

Parameter Description
name Name of the Container Apps environment.
resource-group Name of the resource group.
location The Azure location where the environment is to deploy.
infrastructure-subnet-resource-id Resource ID of a subnet for infrastructure components and user application containers.

With your environment created using a custom virtual network, you can now deploy container apps into the environment.

Optional configuration

You have the option of deploying a private DNS and defining custom networking IP ranges for your Container Apps environment.

Deploy with a private DNS

If you want to deploy your container app with a private DNS, run the following commands.

First, extract identifiable information from the environment.

ENVIRONMENT_DEFAULT_DOMAIN=`az containerapp env show --name ${CONTAINERAPPS_ENVIRONMENT} --resource-group ${RESOURCE_GROUP} --query properties.defaultDomain --out json | tr -d '"'`
ENVIRONMENT_STATIC_IP=`az containerapp env show --name ${CONTAINERAPPS_ENVIRONMENT} --resource-group ${RESOURCE_GROUP} --query properties.staticIp --out json | tr -d '"'`
VNET_ID=`az network vnet show --resource-group ${RESOURCE_GROUP} --name ${VNET_NAME} --query id --out json | tr -d '"'`

Next, set up the private DNS.

az network private-dns zone create \
  --resource-group $RESOURCE_GROUP \
az network private-dns link vnet create \
  --resource-group $RESOURCE_GROUP \
  --name $VNET_NAME \
  --virtual-network $VNET_ID \
  --zone-name $ENVIRONMENT_DEFAULT_DOMAIN -e true
az network private-dns record-set a add-record \
  --resource-group $RESOURCE_GROUP \
  --record-set-name "*" \
  --ipv4-address $ENVIRONMENT_STATIC_IP \

Networking parameters

There are three optional networking parameters you can choose to define when calling containerapp env create. Use these options when you have a peered VNET with separate address ranges. Explicitly configuring these ranges ensures the addresses used by the Container Apps environment don't conflict with other ranges in the network infrastructure.

You must either provide values for all three of these properties, or none of them. If they aren’t provided, the values are generated for you.

Parameter Description
platform-reserved-cidr The address range used internally for environment infrastructure services. Must have a size between /23 and /12 when using the Consumption only architecture
platform-reserved-dns-ip An IP address from the platform-reserved-cidr range that is used for the internal DNS server. The address can't be the first address in the range, or the network address. For example, if platform-reserved-cidr is set to, then platform-reserved-dns-ip can't be (the network address), or (infrastructure reserves use of this IP). In this case, the first usable IP for the DNS would be
docker-bridge-cidr The address range assigned to the Docker bridge network. This range must have a size between /28 and /12.
  • The platform-reserved-cidr and docker-bridge-cidr address ranges can't conflict with each other, or with the ranges of either provided subnet. Further, make sure these ranges don't conflict with any other address range in the VNET.

  • If these properties aren’t provided, the CLI autogenerates the range values based on the address range of the VNET to avoid range conflicts.

Clean up resources

If you're not going to continue to use this application, you can delete the Azure Container Apps instance and all the associated services by removing the my-container-apps resource group. Deleting this resource group will also delete the resource group automatically created by the Container Apps service containing the custom network components.


The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this guide exist in the specified resource group, they will also be deleted.

az group delete --name $RESOURCE_GROUP

Next steps