Unable to establish private link between Azure Front Door and Container Apps Environment (CAE)

Question

Unable to establish private link between Azure Front Door and Container Apps Environment (CAE)

Anonymous

Body: I am trying to enable a private link between my Azure Front Door and my Container Apps Environment (CAE), but I haven’t been successful.

Here’s what I’ve done so far:

During the Front Door creation, I enabled the Private Link feature and selected the target resource (my container app).

This automatically created a private endpoint, for which I provided a name/reason.

I then approved the connection request from the CAE side.

Issue: The approval process takes a very long time and never seems to complete. It just keeps running indefinitely. Once I refresh the page, the status blade disappears, and the private endpoint shows as Approved — even though the approval process never actually completed.

However, when I attempt to access the container app through Front Door, I get a 404 Error response.

Attached is a screenshot showing the approval process hanging.

Has anyone experienced this issue or know what might be causing this behavior? image.png

1 answer

Your answer

Answer 1

Alex Burlachenko 18,570 Volunteer Moderator

hi,

the fact that the status shows 'approved' after a refresh is a classic symptom of a backend timing issue. the approval might have gone through, but the connection is not fully active. the 404 error from front door confirms the link is not working.

first, let's verify the private endpoint connection from the container apps environment side. do not just look at the front door side. go to your container apps environment in the azure portal. in the left menu, look for 'networking' or 'private endpoints'. find the pending private endpoint connection that front door created. even if it looks approved, try to approve it again manually from this side. sometimes this double approval kicks the system into action.

next, check the dns configuration. this is the most common culprit for a 404 after a private link is established. private link requires a specific private dns zone to resolve your container app's name to its private ip address. make sure a private dns zone exists for 'privatelink.azurecontainerapps.io' and that it is linked to your virtual network. it should have an a record that points your container app's hostname to the private ip address assigned by the private endpoint. you can test this by doing an nslookup from a virtual machine inside the same virtual network.

also, look at the container app itself. make sure it is actually running and healthy. if the container app is scaled down to zero or has a failed revision, front door will get a 404 because there is no backend to respond. check the revisions and logs in your container app to confirm it is ready to receive traffic.

this kind of private endpoint delay can happen with any azure service, not just front door and container apps. the approval process can be slow, and the dns propagation is critical. it is always worth checking the dns first.

if you are still stuck, you might need to delete the private endpoint and recreate it. sometimes a fresh start is the fastest solution.

approve the private endpoint from the container apps side, then double and triple check your private dns zone configuration. that is most likely where the problem is hiding.

good luck, my friend. i hope your private link starts behaving after the dns check.

rgds,

Alex

Ravi Varma Mudduluru 3,625 Reputation points Microsoft External Staff Moderator

2025-09-29T18:35:53.17+00:00

Adding to @Alex Burlachenko,

Could you review the document below and ensure that you have followed all the steps when creating the process? Please check and add any steps you may have missed.

https://learn.microsoft.com/en-us/azure/container-apps/how-to-integrate-with-azure-front-door?pivots=azure-portal

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Ravi Varma Mudduluru 3,625 Reputation points Microsoft External Staff Moderator

2025-09-30T23:13:25.05+00:00

Hello @Paa-Kwasi

We have not heard back from you about last response from Alex Burlachenko and would like to check if you have had the opportunity to review the previous post.

Please "upvote" if the information helped you. This will help us and others in the community.
Anonymous

2025-10-03T11:48:58.47+00:00

Hello @Ravi Varma Mudduluru and @Alex Burlachenko

Sorry for the late response. Encountered some unforeseen issues that were beyond my control.

I followed the instructions in the documentation provided as well as those from @Alex Burlachenko

I managed to create the private link between the Front Door and the CAE. But there still is a problem. I have multiple container apps inside the CAE and I could use only one during the Front Door creation to establish the private connection. Now when creating more origins and origin groups, I am asked to specify the subscription ID/alias of the private link I want to use when I enable private link services. But I do not have that available to me and when I use the CAE subscription ID, it returns "this is not valid Private link service ID".

So though I have a private link between Front Door and CAE, it seems to only work for one origin and not multiple since I do not have the Private Link subscription ID
Ravi Varma Mudduluru 3,625 Reputation points Microsoft External Staff Moderator

2025-10-06T11:16:46.63+00:00
Hello @Paa-Kwasi

You're correct, Azure Front Door currently supports Private Link integration with a single origin per Private Link configuration. This is a known limitation when working with multiple container apps within the same Container Apps Environment (CAE).

You can create separate Private Link endpoints for each container app by deploying them in separate CAEs or distinct resource groups.

Alternatively, consider using an internal Azure Load Balancer or Application Gateway in front of your container apps, and then connect Azure Front Door to that single endpoint via Private Link.
Anonymous

2025-10-08T09:03:17.51+00:00

Hi @Ravi Varma Mudduluru

Thank you. I may use the Application Gateway approach since creating multiple CAEs will not be the best solution for me.

Thank you for your help. I will be closing the chat now.

Share via

Unable to establish private link between Azure Front Door and Container Apps Environment (CAE)

1 answer

Your answer