Aspire deployment without containers (only Azure Services)

[jprimke-AXAP]

Hello

Our company does not allow the use of containers on Azure. When I try to use “AddAzureAppServiceEnvironment,” it still attempts to create a container registry and grant the ‘ACR_PULL’ permission to the associated managed identity. This is not permitted for the “Contributor” role.

Are there any plans to change this in the future?

Thank you very much for your support.

Best regards,

Joerg

[Artpupser]

Hi @jprimke-AXAP,

This is a known limitation. AddAzureAppServiceEnvironment always provisions an ACR + managed identity with AcrPull as part of its default Bicep output, because Aspire's deployment model for .NET projects on App Service works by containerizing them and pushing to ACR - even when your workload is just a .NET project with no explicit containers in your AppHost.

The AcrPull role assignment requires Microsoft.Authorization/roleAssignments/write, which is not included in the Contributor role, so your scenario hits a hard permission wall by design.

There is no built-in way to skip ACR provisioning today. However, there are a few paths forward:

Option 1 - Use ConfigureInfrastructure to remove the ACR from the generated Bicep

You can intercept and modify the generated infrastructure to strip out the container registry and role assignment:

builder.AddAzureAppServiceEnvironment("app-service-env")
    .ConfigureInfrastructure(infra =>
    {
        // Remove ACR and its role assignment from the generated resources
        var acr = infra.GetProvisionableResources()
            .OfType<ContainerRegistry>()
            .FirstOrDefault();
        if (acr is not null)
            infra.Remove(acr);

        var roleAssignments = infra.GetProvisionableResources()
            .OfType<RoleAssignment>()
            .Where(r => r.RoleDefinitionId.Value?.Contains("7f951dda") == true); // AcrPull GUID
        foreach (var ra in roleAssignments)
            infra.Remove(ra);
    });

This is not guaranteed to work cleanly depending on your Aspire version, as removing the ACR may break other generated outputs that reference it.

Option 2 - Pre-provision ACR manually and use WithImageRegistry

Have your admin pre-create an ACR with the AcrPull role already assigned to the managed identity, then point Aspire at it so it doesn't try to create one:

builder.AddAzureAppServiceEnvironment("app-service-env")
    .WithImageRegistry("yourregistry.azurecr.io");

Your deployment identity only needs Contributor + permission to use the existing ACR, not create it or assign roles on it.

Option 3 - Run azd infra synth and edit the Bicep manually

Run azd infra synth to export the generated Bicep to disk, remove the ACR resource and role assignment from the template, then use azd provision / azd deploy with the customized Bicep. This gives you full control but requires maintaining the Bicep manually going forward.

---

As for future plans: the ability to deploy containerized .NET projects without ACR (e.g. by using deployment slots or direct zip deploy on App Service) is not on the public roadmap as far as I know, but this is worth raising as a feature request with the label area-azure-appservice. The team has been actively expanding AddAzureAppServiceEnvironment and would likely be receptive to a "no-ACR" or "bring-your-own-ACR-without-role-assignment" option.