# Place an ACR private endpoint outside the subnet delegated to Azure Container Instances

> Review subnet ownership before diagnosing an ACI image-pull deployment failure.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:02+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Review subnet ownership before diagnosing an ACI image-pull deployment failure.

## Potentially affected

Apply this review to the documented ACI deployment pattern that pulls from ACR through a private endpoint. Identify the subnet containing the endpoint and the subnet delegated to the container group. This check does not replace validation of identity, registry access or name resolution.

## DSE recommendation

DSE recommends reviewing the proposed subnet map before retrying the deployment or widening network rules.

## Article

## Source facts

Microsoft requires an Azure Container Registry private endpoint to use a different subnet from the one delegated to Azure Container Instances. An ACI-delegated subnet can contain only container groups. Placing the registry endpoint in that same subnet creates a conflict and causes deployment failure. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/using-azure-container-registry-mi).

## Applicability

Apply this review to the documented ACI deployment pattern that pulls from ACR through a private endpoint. Identify the subnet containing the endpoint and the subnet delegated to the container group. This check does not replace validation of identity, registry access or name resolution.

## DSE recommendation

DSE recommends reviewing the proposed subnet map before retrying the deployment or widening network rules. Record each subnet’s delegation and intended resource types with the network owner. If the endpoint placement conflicts with the documented pattern, prepare a separate approved network change with dependency and rollback review. Preserve the failed deployment details for comparison.

## Verification

Inspect the deployed endpoint and container-group subnet identifiers and confirm they are different. Validate the approved identity and network path with a controlled image pull, then confirm that the intended container starts. Record placement and pull results separately. If the pull still fails, continue the appropriate registry or connectivity investigation without declaring subnet separation a complete deployment guarantee.

## Official references

[Microsoft Learn: Deploy container image from Azure Container Registry using a managed identity](https://learn.microsoft.com/en-us/azure/container-instances/using-azure-container-registry-mi).

## Primary reference

- Name: Deploy container image from Azure Container Registry using a managed identity - Azure Container Instances | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/container-instances/using-azure-container-registry-mi
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Place an ACR private endpoint outside the subnet delegated to Azure Container Instances,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-178-place-an-acr-private-endpoint-outside-the-subnet-delegated-to-azure-container/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.