Place an ACR private endpoint outside the subnet delegated to Azure Container Instances

Source facts

Microsoft requires an Azure Container Registry private endpoint to use a different subnet from the one delegated to Azure Container Instances. An ACI-delegated subnet can contain only container groups. Placing the registry endpoint in that same subnet creates a conflict and causes deployment failure. Microsoft Learn.

Applicability

Apply this review to the documented ACI deployment pattern that pulls from ACR through a private endpoint. Identify the subnet containing the endpoint and the subnet delegated to the container group. This check does not replace validation of identity, registry access or name resolution.

DSE recommendation

DSE recommends reviewing the proposed subnet map before retrying the deployment or widening network rules. Record each subnet’s delegation and intended resource types with the network owner. If the endpoint placement conflicts with the documented pattern, prepare a separate approved network change with dependency and rollback review. Preserve the failed deployment details for comparison.

Verification

Inspect the deployed endpoint and container-group subnet identifiers and confirm they are different. Validate the approved identity and network path with a controlled image pull, then confirm that the intended container starts. Record placement and pull results separately. If the pull still fails, continue the appropriate registry or connectivity investigation without declaring subnet separation a complete deployment guarantee.

Official references

Microsoft Learn: Deploy container image from Azure Container Registry using a managed identity.