{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/", "slug": "dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container", "url": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/" }, "title": "Place an ACR private endpoint outside the subnet delegated to Azure Container Instances", "summary": "Review subnet ownership before diagnosing an ACI image-pull deployment failure.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:02+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 2, "word_count": 223, "potentially_affected": "Apply this review to the documented ACI deployment pattern that pulls from ACR through a private endpoint. Identify the subnet containing the endpoint and the subnet delegated to the container group. This check does not replace validation of identity, registry access or name resolution.", "dse_recommendation": "DSE recommends reviewing the proposed subnet map before retrying the deployment or widening network rules.", "primary_source": { "name": "Deploy container image from Azure Container Registry using a managed identity - Azure Container Instances | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/container-instances/using-azure-container-registry-mi", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft requires an Azure Container Registry private endpoint to use a different subnet from the one delegated to Azure Container Instances. An ACI-delegated subnet can contain only container groups. Placing the registry endpoint in that same subnet creates a conflict and causes deployment failure. Microsoft Learn.

\n

Applicability

\n

Apply this review to the documented ACI deployment pattern that pulls from ACR through a private endpoint. Identify the subnet containing the endpoint and the subnet delegated to the container group. This check does not replace validation of identity, registry access or name resolution.

\n

DSE recommendation

\n

DSE recommends reviewing the proposed subnet map before retrying the deployment or widening network rules. Record each subnet’s delegation and intended resource types with the network owner. If the endpoint placement conflicts with the documented pattern, prepare a separate approved network change with dependency and rollback review. Preserve the failed deployment details for comparison.

\n

Verification

\n

Inspect the deployed endpoint and container-group subnet identifiers and confirm they are different. Validate the approved identity and network path with a controlled image pull, then confirm that the intended container starts. Record placement and pull results separately. If the pull still fails, continue the appropriate registry or connectivity investigation without declaring subnet separation a complete deployment guarantee.

\n

Official references

\n

Microsoft Learn: Deploy container image from Azure Container Registry using a managed identity.

", "content_text": "Source facts\nMicrosoft requires an Azure Container Registry private endpoint to use a different subnet from the one delegated to Azure Container Instances. An ACI-delegated subnet can contain only container groups. Placing the registry endpoint in that same subnet creates a conflict and causes deployment failure. Microsoft Learn.\nApplicability\nApply this review to the documented ACI deployment pattern that pulls from ACR through a private endpoint. Identify the subnet containing the endpoint and the subnet delegated to the container group. This check does not replace validation of identity, registry access or name resolution.\nDSE recommendation\nDSE recommends reviewing the proposed subnet map before retrying the deployment or widening network rules. Record each subnet’s delegation and intended resource types with the network owner. If the endpoint placement conflicts with the documented pattern, prepare a separate approved network change with dependency and rollback review. Preserve the failed deployment details for comparison.\nVerification\nInspect the deployed endpoint and container-group subnet identifiers and confirm they are different. Validate the approved identity and network path with a controlled image pull, then confirm that the intended container starts. Record placement and pull results separately. If the pull still fails, continue the appropriate registry or connectivity investigation without declaring subnet separation a complete deployment guarantee.\nOfficial references\nMicrosoft Learn: Deploy container image from Azure Container Registry using a managed identity.", "content_markdown": "## Source facts\n\nMicrosoft requires an Azure Container Registry private endpoint to use a different subnet from the one delegated to Azure Container Instances. An ACI-delegated subnet can contain only container groups. Placing the registry endpoint in that same subnet creates a conflict and causes deployment failure. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/using-azure-container-registry-mi).\n\n## Applicability\n\nApply this review to the documented ACI deployment pattern that pulls from ACR through a private endpoint. Identify the subnet containing the endpoint and the subnet delegated to the container group. This check does not replace validation of identity, registry access or name resolution.\n\n## DSE recommendation\n\nDSE recommends reviewing the proposed subnet map before retrying the deployment or widening network rules. Record each subnet’s delegation and intended resource types with the network owner. If the endpoint placement conflicts with the documented pattern, prepare a separate approved network change with dependency and rollback review. Preserve the failed deployment details for comparison.\n\n## Verification\n\nInspect the deployed endpoint and container-group subnet identifiers and confirm they are different. Validate the approved identity and network path with a controlled image pull, then confirm that the intended container starts. Record placement and pull results separately. If the pull still fails, continue the appropriate registry or connectivity investigation without declaring subnet separation a complete deployment guarantee.\n\n## Official references\n\n[Microsoft Learn: Deploy container image from Azure Container Registry using a managed identity](https://learn.microsoft.com/en-us/azure/container-instances/using-azure-container-registry-mi)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/", "url": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Place an ACR private endpoint outside the subnet delegated to Azure Container Instances", "item": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/", "url": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/", "headline": "Place an ACR private endpoint outside the subnet delegated to Azure Container Instances", "description": "Review subnet ownership before diagnosing an ACI image-pull deployment failure.", "abstract": "Review subnet ownership before diagnosing an ACI image-pull deployment failure.", "articleBody": "Source facts\nMicrosoft requires an Azure Container Registry private endpoint to use a different subnet from the one delegated to Azure Container Instances. An ACI-delegated subnet can contain only container groups. Placing the registry endpoint in that same subnet creates a conflict and causes deployment failure. Microsoft Learn.\nApplicability\nApply this review to the documented ACI deployment pattern that pulls from ACR through a private endpoint. Identify the subnet containing the endpoint and the subnet delegated to the container group. This check does not replace validation of identity, registry access or name resolution.\nDSE recommendation\nDSE recommends reviewing the proposed subnet map before retrying the deployment or widening network rules. Record each subnet’s delegation and intended resource types with the network owner. If the endpoint placement conflicts with the documented pattern, prepare a separate approved network change with dependency and rollback review. Preserve the failed deployment details for comparison.\nVerification\nInspect the deployed endpoint and container-group subnet identifiers and confirm they are different. Validate the approved identity and network path with a controlled image pull, then confirm that the intended container starts. Record placement and pull results separately. If the pull still fails, continue the appropriate registry or connectivity investigation without declaring subnet separation a complete deployment guarantee.\nOfficial references\nMicrosoft Learn: Deploy container image from Azure Container Registry using a managed identity.", "datePublished": "2026-09-17T16:32:02+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Place an ACR private endpoint outside the subnet delegated to Azure Container Instances" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 223, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Deploy container image from Azure Container Registry using a managed identity - Azure Container Instances | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/container-instances/using-azure-container-registry-mi" } } ] } }