> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Container Apps sandboxes sandboxes

> Run CostGraph workflows and CI jobs in Azure Container Apps sandboxes sandboxes: the key to create, its permissions, and its limits

Azure Container Apps Sandboxes are isolated, suspendable compute instances (Microsoft.App/SandboxGroups) created from OCI disk images and controlled through a data-plane SDK/REST API.

The following table shows what CostGraph runs on this provider.

| Workflows | CI runners | Connect with |
| - | - | - |
| Yes | Yes | Integrations or your own dispatcher |

## Connect

Connect Azure Container Apps sandboxes on Integrations, and CostGraph starts sandboxes in your Azure Container Apps sandboxes account. You don't run anything yourself.

1. In CostGraph, go to **Integrations > Sandbox > Azure Container Apps sandboxes**.

2. Enter these fields:

   * **Tenant ID** (`AZURE_TENANT_ID`, required): The Microsoft Entra tenant of the service principal.
   * **Client ID** (`AZURE_CLIENT_ID`, required): The application (client) ID of the service principal.
   * **Client secret** (`AZURE_CLIENT_SECRET`, required): A client secret of that service principal.
   * **Subscription ID** (`AZURE_SUBSCRIPTION_ID`, required): The subscription that holds the sandbox group.
   * **Resource group** (`AZURE_RESOURCE_GROUP`, required): The resource group that holds the sandbox group.
   * **Sandbox group** (`AZURE_SANDBOX_GROUP`, required): The name of the sandbox group sandboxes are created in.
   * **Region** (`AZURE_REGION`, required): The region of the sandbox group.

3. Click **Connect**.

### Your own dispatcher

To keep the key out of CostGraph or reach a private network, run your own dispatcher instead.
Set `provider` to `azure` and the preceding fields as environment variables, as described in [Run your own dispatcher](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md#run-your-own-dispatcher).

## Key and permissions

AZURE\_TENANT\_ID, AZURE\_CLIENT\_ID and AZURE\_CLIENT\_SECRET are a Microsoft Entra service principal (app registration + client secret, for example from Entra ID > App registrations > Certificates & secrets, or az ad sp create-for-rbac). AZURE\_SUBSCRIPTION\_ID and AZURE\_RESOURCE\_GROUP locate the sandbox group; AZURE\_SANDBOX\_GROUP is an existing sandbox group (an ARM resource you create first); AZURE\_REGION is the sandbox group's region (selects the data-plane endpoint).

Built-in role 'Container Apps SandboxGroup Data Owner' (role definition id c24cf47c-5077-412d-a19c-45202126392c) assigned to the service principal. Docs say it can be assigned at subscription or resource group scope; the quickstart assigns it at the sandbox group scope (/subscriptions/\<sub>/resourceGroups/\<rg>/providers/Microsoft.App/sandboxGroups/\<group>), the narrowest documented. CostGraph only uses data-plane sandbox create/get/list/delete/exec, so no ARM role is needed if the sandbox group already exists. Role assignments take 30-60 s to propagate.

Sources: [learn.microsoft.com: sandboxes overview](https://learn.microsoft.com/en-us/azure/container-apps/sandboxes-overview), [learn.microsoft.com: sandboxes quickstart python sdk](https://learn.microsoft.com/en-us/azure/container-apps/sandboxes-quickstart-python-sdk), [pypi.org: 0.1.0b3](https://pypi.org/project/azure-containerapps-sandbox/0.1.0b3).

## Limits

* Resource tiers range from XS (0.25 core / 0.5 GiB) to 3XL (16 cores / 32 GiB / 320 GiB disk). ([source](https://learn.microsoft.com/en-us/azure/container-apps/sandboxes-overview))
* Auto-suspend after an idle timeout is optional per sandbox (CostGraph turns it off); idle means no ingress, no exec, no shell, no file ops. No max lifetime is documented. ([source](https://learn.microsoft.com/en-us/azure/container-apps/sandboxes-overview))
* Only Microsoft Entra ID identities can access sandboxes; personal Microsoft accounts are not supported. ([source](https://learn.microsoft.com/en-us/azure/container-apps/sandboxes-overview))
* Preview: the Python SDK is a beta package (azure-containerapps-sandbox 0.1.0b3); supported region list is not documented on the overview (quickstart uses eastus2). ([source](https://pypi.org/project/azure-containerapps-sandbox/0.1.0b3))

## Related

* [Supported sandbox providers](https://docs.costgraph.ai/costgraph/workflows/sandbox-providers.md)
* [Run workflows on a managed sandbox provider](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md)
* [Run CI jobs in sandboxes](https://docs.costgraph.ai/costgraph/autopilot/ci-sandboxes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.