Improve Azure Sandbox defaults by mitchdenny · Pull Request #19810 · microsoft/aspire

Mitch Denny (mitchdenny) · 2026-08-31T01:28:02Z

Description

Azure Sandbox groups now work as compute environments without requiring every workload to opt in through PublishAsAzureSandbox. A simple AppHost can add one sandbox group and one .NET project, and Aspire automatically assigns and deploys the project while keeping its endpoints private by default.

PublishAsAzureSandbox now configures sandbox-specific runtime options only. With one compute environment, Aspire infers the sandbox group; with multiple environments, workloads select one through WithComputeEnvironment.

Public ingress follows the standard Aspire endpoint convention and requires an explicitly external endpoint, for example through WithExternalHttpEndpoints(). For .NET projects with paired external HTTP and HTTPS endpoints, the sandbox deployment:

exposes one shared container port;
terminates TLS at the sandbox proxy and forwards HTTP to the container;
resolves both app-model endpoint references to the same HTTPS sandbox URL;
merges endpoint access policy on the shared target port and rejects conflicting policies.

Coverage includes automatic private .NET project adoption, explicit paired HTTP/HTTPS endpoint translation, multiple sandbox groups with one project each, and Azure deployment E2E coverage for TLS termination and the backend HTTP port.

User-facing usage

A project is assigned automatically and remains private unless ingress is requested:

#pragma warning disable ASPIREAZURE001

builder.AddAzureSandboxGroup("env");
builder.AddProject<Projects.ApiService>("api");

External ingress and sandbox options can be configured explicitly without passing the environment:

builder.AddProject<Projects.ApiService>("api")
    .WithExternalHttpEndpoints()
    .PublishAsAzureSandbox(new AzureSandboxOptions
    {
        Tier = AzureSandboxTier.Medium
    });

TypeScript AppHost:

await builder.addAzureSandboxGroup("env");

await api.publishAsAzureSandbox({
    tier: AzureSandboxTier.Medium
});

Breaking changes

The sandbox-group parameter was removed from PublishAsAzureSandbox. Existing callers should rely on single-environment inference or call WithComputeEnvironment(sandboxGroup) before PublishAsAzureSandbox(options) when multiple compute environments exist.

PublicEndpointReadyTimeout was removed from AzureSandboxGroupOptions. Sandbox deployment no longer probes public endpoint readiness; readiness is reported by the Azure deployment operation instead.

Security considerations

Automatic workload assignment does not automatically expose endpoints. Only endpoints explicitly marked external become Sandbox ports. Public Sandbox ports remain Entra-authenticated by default, and anonymous access remains opt-in through AzureSandboxEndpointOptions.Anonymous. The Sandbox proxy terminates TLS while traffic to the container uses HTTP on the shared target port.

Validation

99 AzureSandboxesTests passed.
Aspire.Deployment.EndToEnd.Tests builds successfully.
Full repository build completed successfully with native compilation skipped.
Added Azure deployment E2E coverage for a .NET service with paired HTTP/HTTPS endpoints.

Fixes # (issue)

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No

Mitch Denny (mitchdenny) · 2026-08-31T01:28:05Z

/deployment-test

github-actions · 2026-08-31T01:28:21Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19810

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19810"

github-actions · 2026-08-31T01:28:34Z

🚀 Deployment tests starting on PR #19810...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

Copilot

Copilot review overview

Review tier: Balanced
Findings: 1 · 2

New issues introduced by this change (3)

Severity	Finding
	`src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs` — `PublishAsAzureSandbox` can now silently do nothing when no Azure sandbox group exists (or when the…
	`src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs` — This condition disables the documented automatic project endpoint whenever any endpoint is…
	`src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxEndpointPropertyValueProvider.cs` — Removing the external-endpoint guard makes the existing target-port fallback apply to containers…

What changed in this PR

Enables Azure Sandbox groups to automatically adopt workloads and adds sensible .NET HTTP/HTTPS deployment defaults.

Changes:

Simplifies PublishAsAzureSandbox to configure runtime options only.
Maps paired .NET endpoints to one TLS-terminated port on 8080.
Adds unit, polyglot, and Azure deployment coverage.

File	Description
`AzureSandboxesExtensions.cs`	Simplifies sandbox publishing API.
`AzureSandboxContainerDeployment.cs`	Adds endpoint adoption and port merging.
`AzureSandboxEndpointPropertyValueProvider.cs`	Resolves shared deployed endpoint URLs.
`README.md`	Documents new defaults and API usage.
`AzureSandboxesTests.cs`	Adds focused unit coverage.
`AzureSandboxesDeploymentTests.cs`	Adds live .NET deployment validation.
`TypeScript/apphost.mts`	Updates generated TypeScript API usage.

Copilot

Copilot review overview

🔵 Needs a closer look

The C# README example references a private workload despite private Sandbox service discovery being unsupported.

Review tier: Balanced
Findings: None

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

src/Aspire.Hosting.Azure.Sandboxes/README.md:34

The minimal C# example is not deployable as shown. api remains private, but WithReference(api) injects its endpoints into frontend; sandbox resolution throws for endpoints that are not exposed (AzureSandboxEndpointPropertyValueProvider.cs:184), and this README lists private service discovery as unsupported at line 119. Expose and configure the API before referencing it, or demonstrate a supported dependency while preserving the private-default example.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e

Copilot

Copilot review overview

🟡 Changes recommended

An excluded sandbox group can still become the default compute environment and create an unusable deployment target.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	`src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs` — This guard only suppresses the summary item; the excluded group still participates in automatic…

Preserve main's named-port and Entra allowlist request shape while retaining the secure authenticated-port default. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e

Mitch Denny (mitchdenny) · 2026-09-04T01:30:24Z

/deployment-test

github-actions · 2026-09-04T01:30:43Z

🚀 Deployment tests starting on PR #19810...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

Copilot

Copilot review overview

🟡 Changes recommended

The minimal C# README example references a private endpoint that sandbox deployment cannot resolve.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 1

New issues introduced by this change (1)

Severity	Finding
	`src/Aspire.Hosting.Azure.Sandboxes/README.md` — This advertised private-by-default example cannot deploy as written. `WithReference(api)` injects…

Pre-existing issues (1)

Severity	Finding
	`src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs` — This guard only suppresses the summary item; the excluded group still participates in automatic… View comment

github-actions · 2026-09-04T01:51:07Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

github-actions · 2026-09-04T02:04:17Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

github-actions · 2026-09-04T02:17:12Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e

Copilot

Copilot review overview

🟡 Changes recommended

The deployment test’s ANSI normalization misses OSC hyperlinks, and the documented private-reference example cannot deploy as presented.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2 · 1

New issues introduced by this change (1)

Severity	Finding
	`tests/Aspire.Deployment.EndToEnd.Tests/AzureSandboxesDeploymentTests.cs` — This removes CSI color codes but leaves OSC 8 hyperlink sequences. The CLI renders each Markdown…

Pre-existing issues (2)

Severity	Finding
	`src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs` — This guard only suppresses the summary item; the excluded group still participates in automatic… View comment
	`src/Aspire.Hosting.Azure.Sandboxes/README.md` — This advertised private-by-default example cannot deploy as written. `WithReference(api)` injects… View comment

Suppressed comments (1)

src/Aspire.Hosting.Azure.Sandboxes/README.md:34

This “automatic” example is not deployable if the following optional customization block is omitted. api has only private endpoints, but frontend.WithReference(api) requires an endpoint URL; Sandbox creates URLs only for external endpoints, and this README also lists private service discovery as unsupported. Resolving the reference therefore fails with “not exposed by the Azure sandbox deployment target.” Either avoid the private cross-workload reference in the minimal example or make the API explicitly external with an access policy that the frontend can use.

builder.AddProject<Projects.WebFrontend>("frontend")
    .WithReference(api);

github-actions · 2026-09-05T04:52:17Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e

Mitch Denny (mitchdenny) · 2026-09-05T06:55:59Z

/deployment-test

github-actions · 2026-09-05T06:56:26Z

🚀 Deployment tests starting on PR #19810...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

github-actions · 2026-09-05T06:57:43Z

Tests selector

2 / 99 PR test projects · 3 PR jobs · 2 advisory-only targets, from 9 changed files.

Selected PR test projects (2 / 99)

Aspire.Hosting.Azure.Kubernetes.Tests, Aspire.Hosting.Azure.Tests

Selected PR jobs (3)

extension-e2e, polyglot, typescript-api-compat

Advisory workflow impact (2)

Aspire.Deployment.EndToEnd.Tests (deployment workflow-only)
deployment-e2e (schedule/dispatch-only)

How these were chosen — grouped by what changed

🧪 tests/Aspire.Hosting.Azure.Tests/AzureSandboxesTests.cs (changed test)
→ 1 directly: Aspire.Hosting.Azure.Tests
→ 1 via the project graph: Aspire.Hosting.Azure.Kubernetes.Tests

🔧 src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs (changed source)
→ 1 directly: Aspire.Hosting.Azure.Tests

🔧 src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerOptionsAnnotation.cs (changed source)
→ 1 directly: Aspire.Hosting.Azure.Tests

🔧 src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxEndpointPropertyValueProvider.cs (changed source)
→ 1 directly: Aspire.Hosting.Azure.Tests

🔧 src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs (changed source)
→ 1 directly: Aspire.Hosting.Azure.Tests

🔧 src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs (changed source)
→ 1 directly: Aspire.Hosting.Azure.Tests

🔧 src/Aspire.Hosting.Azure.Sandboxes/Internal/Adc/AzureDevComputeClient.cs (changed source)
→ 1 directly: Aspire.Hosting.Azure.Tests

🧪 tests/Aspire.Deployment.EndToEnd.Tests/AzureSandboxesDeploymentTests.cs (changed test)
→ 1 directly: Aspire.Deployment.EndToEnd.Tests

Job reasons

Job	Triggered by
`deployment-e2e`	• `tests/Aspire.Deployment.EndToEnd.Tests/AzureSandboxesDeploymentTests.cs` • affected project `Aspire.Hosting.Azure.Sandboxes`
`extension-e2e`	• `src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs`, `src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerOptionsAnnotation.cs`, `src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxEndpointPropertyValueProvider.cs`, `src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs`, `src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs`, `src/Aspire.Hosting.Azure.Sandboxes/Internal/Adc/AzureDevComputeClient.cs` • affected project `Aspire.Hosting.Azure.Sandboxes`
`polyglot`	`tests/PolyglotAppHosts/Aspire.Hosting.Azure.Sandboxes/TypeScript/apphost.mts`
`typescript-api-compat`	affected project `Aspire.Hosting.Azure.Sandboxes`

Selection computed for commit 977482e.

Copilot

Copilot review overview

🔵 Needs a closer look

The changes alter cloud deployment, networking, authentication, and public API behavior and warrant final human review despite comprehensive coverage.

Review tier: Balanced
Findings: None

Issues resolved since last review (3)

Severity	Finding
	`tests/Aspire.Deployment.EndToEnd.Tests/AzureSandboxesDeploymentTests.cs` — This removes CSI color codes but leaves OSC 8 hyperlink sequences. The CLI renders each Markdown… View resolved comment
	`src/Aspire.Hosting.Azure.Sandboxes/README.md` — This advertised private-by-default example cannot deploy as written. `WithReference(api)` injects… View resolved comment
	`src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs` — This guard only suppresses the summary item; the excluded group still participates in automatic… View resolved comment

github-actions · 2026-09-05T07:17:35Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

aspire-repo-bot · 2026-09-05T07:36:53Z

Pull request created: #1623

Generated by PR Documentation Check · auto · 97.6 AIC · ⌖ 6.75 AIC · ⊞ 19.6K

aspire-repo-bot · 2026-09-05T07:37:18Z

📝 Documentation has been drafted in microsoft/aspire.dev#1623 targeting release/13.6.

Updated src/frontend/src/content/docs/whats-new/aspire-13-6.mdx to describe the Azure Container Apps Sandboxes breaking change: PublishAsAzureSandbox/publishAsAzureSandbox no longer takes a sandbox-group parameter (compute environment is now inferred, or selected via WithComputeEnvironment), and PublicEndpointReadyTimeout was removed from AzureSandboxGroupOptions. Added C#/TypeScript samples and a new Breaking changes entry, and updated the New integrations summary.

Note

This draft PR needs human review before merging.

Copilot AI balanced review requested due to automatic review settings August 31, 2026 01:28

Mitch Denny (mitchdenny) added the breaking-change Issue or PR that represents a breaking API or functional change over a prerelease. label Aug 31, 2026

github-actions Bot added the area-integrations Issues pertaining to Aspire Integrations packages label Aug 31, 2026

Copilot started reviewing on behalf of Mitch Denny (mitchdenny) August 31, 2026 01:28 View session

github-actions Bot temporarily deployed to deployment-testing August 31, 2026 01:30 Inactive

This comment has been minimized.

Sign in to view

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Comment thread src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs

Comment thread src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs Outdated

Comment thread src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxEndpointPropertyValueProvider.cs

github-actions Bot temporarily deployed to deployment-testing August 31, 2026 01:38 Inactive

github-actions Bot had a problem deploying to deployment-testing August 31, 2026 01:38 Failure

github-actions Bot temporarily deployed to deployment-testing August 31, 2026 01:38 Inactive

This comment has been minimized.

Sign in to view

Copilot AI reviewed Sep 3, 2026

View reviewed changes

Mitch Denny (mitchdenny) mentioned this pull request Sep 3, 2026

Allow resources to declare outbound hosts for compute environments #19883

Open

1 task

Track sandbox egress metadata follow-up

1dc19d9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e

Copilot AI reviewed Sep 3, 2026

View reviewed changes

Comment thread src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs

This comment has been minimized.

Sign in to view

Merge main into Azure Sandbox defaults

4670afd

Preserve main's named-port and Entra allowlist request shape while retaining the secure authenticated-port default. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e

This comment has been minimized.

Sign in to view

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Comment thread src/Aspire.Hosting.Azure.Sandboxes/README.md Outdated

Eric Erhardt (eerhardt) approved these changes Sep 4, 2026

View reviewed changes

Merge main into Azure Sandbox defaults

a167211

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e

This comment has been minimized.

Sign in to view

Copilot AI reviewed Sep 5, 2026

View reviewed changes

Comment thread tests/Aspire.Deployment.EndToEnd.Tests/AzureSandboxesDeploymentTests.cs Outdated

Fix Sandbox documentation and E2E output parsing

977482e

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e

Copilot AI reviewed Sep 5, 2026

View reviewed changes

aspire-repo-bot Bot mentioned this pull request Sep 5, 2026

[docs] Document Azure Sandbox default compute environment inference microsoft/aspire.dev#1623

Draft

Mitch Denny (mitchdenny) mentioned this pull request Sep 6, 2026

Enable data-plane references for Azure Sandbox Groups #19886

Draft

14 tasks

David Pine (IEvangelist) mentioned this pull request Sep 8, 2026

PR Documentation Check fails to create docs PRs for release branches #19054

Open

50 tasks

Uh oh!

Conversation

Mitch Denny (mitchdenny) commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing usage

Breaking changes

Security considerations

Validation

Checklist

Uh oh!

Mitch Denny (mitchdenny) commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

Mitch Denny (mitchdenny) commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

Mitch Denny (mitchdenny) commented Sep 5, 2026

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

github-actions Bot commented Sep 5, 2026

Tests selector

Selected PR test projects (2 / 99)

Selected PR jobs (3)

Advisory workflow impact (2)

Job reasons

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Mitch Denny (mitchdenny) commented Aug 31, 2026 •

edited

Loading