# Split AGIC ingress resources when backend path prefixes must differ

> The backend-path-prefix annotation affects the entire ingress resource, not just the first rule in an example.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:22:05+00:00
- Modified: 2026-09-10T02:14:32+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The backend-path-prefix annotation affects the entire ingress resource, not just the first rule in an example.

## Potentially affected

Kubernetes ingress resources managed by Application Gateway Ingress Controller with backend path overrides.

## DSE recommendation

Group paths by their required backend prefix before applying the ingress-level annotation.

## Article

## Source facts

The AGIC backend-path-prefix annotation configures an HTTP setting with a backend path override. Microsoft warns that its single-rule example does not limit annotation scope: the annotation applies across the ingress resource and affects every specified path.

Rules that need different backend path prefixes must be defined in separate ingress resources, even when they use the same service. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations).

## Applicability

Review the actual AGIC ingress, all of its path rules and the backend path expected by each application. Do not transfer this annotation behavior to another ingress controller without checking its own documentation.

## DSE recommendation

DSE recommends comparing the complete ingress rule set before adding a prefix override to fix one application path. Separate paths that require different prefixes into the documented resource arrangement, with the application owner reviewing the resulting route map. Avoid accepting a one-path test as evidence that neighboring routes retain their intended backend paths.

## Verification

Use an approved environment to request each affected path and inspect the path actually received at the backend. Include neighboring rules sharing the original ingress and confirm the intended separation after an authorized split. Check the rendered Application Gateway configuration as well as the application response. Preserve the ingress manifests and path-by-path outcomes so later consolidation does not silently reintroduce a shared override.

## Official references

[Microsoft Learn: Application Gateway Ingress Controller annotations](https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations). Source retrieved September 9, 2026.

## Primary reference

- Name: Application Gateway Ingress Controller annotations | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Split AGIC ingress resources when backend path prefixes must differ,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-591-split-agic-ingress-resources-when-backend-path-prefixes-must-differ/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.