Skip to main content
Azure Container Apps Sandboxes are isolated, suspendable compute instances (Microsoft.App/SandboxGroups) created from OCI disk images and controlled through a data-plane SDK/REST API. The following table shows what CostGraph runs on this provider.

​
Connect

Run the dispatcher with provider set to azure and these variables:
  • AZURE_TENANT_ID
  • AZURE_CLIENT_ID
  • AZURE_CLIENT_SECRET
  • AZURE_SUBSCRIPTION_ID
  • AZURE_RESOURCE_GROUP
  • AZURE_SANDBOX_GROUP
  • AZURE_REGION

​
Key and permissions

AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET are a Microsoft Entra service principal (app registration + client secret, for example from Entra ID > App registrations > Certificates & secrets, or az ad sp create-for-rbac). AZURE_SUBSCRIPTION_ID and AZURE_RESOURCE_GROUP locate the sandbox group; AZURE_SANDBOX_GROUP is an existing sandbox group (an ARM resource you create first); AZURE_REGION is the sandbox group’s region (selects the data-plane endpoint). Built-in role ‘Container Apps SandboxGroup Data Owner’ (role definition id c24cf47c-5077-412d-a19c-45202126392c) assigned to the service principal. Docs say it can be assigned at subscription or resource group scope; the quickstart assigns it at the sandbox group scope (/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.App/sandboxGroups/<group>), the narrowest documented. CostGraph only uses data-plane sandbox create/get/list/delete/exec, so no ARM role is needed if the sandbox group already exists. Role assignments take 30-60 s to propagate. Sources: learn.microsoft.com: sandboxes overview, learn.microsoft.com: sandboxes quickstart python sdk, pypi.org: 0.1.0b3.

​
Limits

  • Resource tiers range from XS (0.25 core / 0.5 GiB) to 3XL (16 cores / 32 GiB / 320 GiB disk). (source)
  • Auto-suspend after an idle timeout is optional per sandbox (CostGraph turns it off); idle means no ingress, no exec, no shell, no file ops. No max lifetime is documented. (source)
  • Only Microsoft Entra ID identities can access sandboxes; personal Microsoft accounts are not supported. (source)
  • Preview: the Python SDK is a beta package (azure-containerapps-sandbox 0.1.0b3); supported region list is not documented on the overview (quickstart uses eastus2). (source)