# AzureSandboxesExtensions Methods

- Package: [Aspire.Hosting.Azure.Sandboxes](/reference/api/csharp/aspire.hosting.azure.sandboxes.md)
- Type: [AzureSandboxesExtensions](/reference/api/csharp/aspire.hosting.azure.sandboxes/azuresandboxesextensions.md)
- Kind: `Methods`
- Members: `7`

Extension methods for adding Azure Container Apps sandbox resources to the application model.

<a id="addazuresandboxgroup"></a>
<a id="addazuresandboxgroup-idistributedapplicationbuilder-string"></a>

## AddAzureSandboxGroup(IDistributedApplicationBuilder, string)

- Name: `AddAzureSandboxGroup(IDistributedApplicationBuilder, string)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<AzureSandboxGroupResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs#L40-L137)

Adds an Azure Container Apps sandbox group resource to the application model.

```csharp
public static class AzureSandboxesExtensions
{
    public static IResourceBuilder<AzureSandboxGroupResource> AddAzureSandboxGroup(
        this IDistributedApplicationBuilder builder,
        string name)
    {
        // ...
    }
}
```

## Parameters

- `builder` (`IDistributedApplicationBuilder`)
  The distributed application builder.
- `name` (`string`)
  The name of the resource.

## Returns

`IResourceBuilder<AzureSandboxGroupResource>` -- A resource builder for the sandbox group.

## ATS metadata

### ATS export

- Available to Polyglot AppHosts through the Aspire Type System.

<a id="publishasazuresandbox"></a>
<a id="publishasazuresandbox-iresourcebuilder-t-azuresandboxoptions"></a>

## PublishAsAzureSandbox(IResourceBuilder<T>, AzureSandboxOptions?)

- Name: `PublishAsAzureSandbox(IResourceBuilder<T>, AzureSandboxOptions?)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<T>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs#L160-L175)

Configures the specified compute resource when it is published as an Azure sandbox container.

```csharp
public static class AzureSandboxesExtensions
{
    public static IResourceBuilder<T> PublishAsAzureSandbox<T>(
        this IResourceBuilder<T> builder,
        AzureSandboxOptions? options = null)
    {
        // ...
    }
}
```

## Parameters

- `builder` (`IResourceBuilder<T>`)
  The compute resource builder.
- `options` ([AzureSandboxOptions?](/reference/api/csharp/aspire.hosting.azure.sandboxes/azuresandboxoptions.md)) `optional`
  The sandbox runtime options.

## Returns

`IResourceBuilder<T>` -- The resource builder.

## Exceptions

- `ArgumentNullException` -- Thrown when `builder` is null.
- `ArgumentException` -- Thrown when a configured option is invalid.

## Remarks

When the application model contains a single compute environment, Aspire assigns the resource to that environment automatically. When multiple compute environments exist, call `WithComputeEnvironment` before this method.

## ATS metadata

### ATS export

- Capability ID: `Aspire.Hosting.Azure.Sandboxes/publishComputeResourceAsAzureSandbox`
- Generated method name override: `publishAsAzureSandbox`

<a id="publishasazuresandbox-iresourcebuilder-t-action-azuresandboxoptions"></a>

## PublishAsAzureSandbox(IResourceBuilder<T>, Action<AzureSandboxOptions>)

- Name: `PublishAsAzureSandbox(IResourceBuilder<T>, Action<AzureSandboxOptions>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<T>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs#L193-L204)

Configures the specified compute resource when it is published as an Azure sandbox container.

```csharp
public static class AzureSandboxesExtensions
{
    public static IResourceBuilder<T> PublishAsAzureSandbox<T>(
        this IResourceBuilder<T> builder,
        Action<AzureSandboxOptions> configure)
    {
        // ...
    }
}
```

## Parameters

- `builder` (`IResourceBuilder<T>`)
  The compute resource builder.
- `configure` (`Action<AzureSandboxOptions>`)
  The callback that configures sandbox runtime options.

## Returns

`IResourceBuilder<T>` -- The resource builder.

## Exceptions

- `ArgumentNullException` -- Thrown when `builder` or `configure` is null.
- `ArgumentException` -- Thrown when a configured option is invalid.

## ATS metadata

### Ignored by ATS

- Reason: Use the AzureSandboxOptions overload from ATS.

<a id="withacrpullidentity"></a>
<a id="withacrpullidentity-iresourcebuilder-azuresandboxgroupresource-iresourcebuilder-azureuserassignedidentityresource"></a>

## WithAcrPullIdentity(IResourceBuilder<AzureSandboxGroupResource>, IResourceBuilder<AzureUserAssignedIdentityResource>)

- Name: `WithAcrPullIdentity(IResourceBuilder<AzureSandboxGroupResource>, IResourceBuilder<AzureUserAssignedIdentityResource>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<AzureSandboxGroupResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs#L290-L296)

Configures the user-assigned managed identity that Azure Dev Compute uses to pull sandbox images from the configured Azure Container Registry.

```csharp
public static class AzureSandboxesExtensions
{
    public static IResourceBuilder<AzureSandboxGroupResource> WithAcrPullIdentity(
        this IResourceBuilder<AzureSandboxGroupResource> builder,
        IResourceBuilder<AzureUserAssignedIdentityResource> identity)
    {
        // ...
    }
}
```

## Parameters

- `builder` (`IResourceBuilder<AzureSandboxGroupResource>`)
  The sandbox group resource builder.
- `identity` (`IResourceBuilder<AzureUserAssignedIdentityResource>`)
  The user-assigned managed identity resource.

## Returns

`IResourceBuilder<AzureSandboxGroupResource>` -- The resource builder.

## Remarks

The supplied identity must be attached to an existing sandbox group and have the `AcrPull` role on its registry. For sandbox groups created by Aspire, the identity is attached automatically, but the caller remains responsible for granting `AcrPull`.

## ATS metadata

### ATS export

- Available to Polyglot AppHosts through the Aspire Type System.

<a id="withnomanagedidentity"></a>
<a id="withnomanagedidentity-iresourcebuilder-azuresandboxgroupresource"></a>

## WithNoManagedIdentity(IResourceBuilder<AzureSandboxGroupResource>)

- Name: `WithNoManagedIdentity(IResourceBuilder<AzureSandboxGroupResource>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<AzureSandboxGroupResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs#L221-L225)

Clears the managed identities explicitly configured for sandbox workloads.

```csharp
public static class AzureSandboxesExtensions
{
    public static IResourceBuilder<AzureSandboxGroupResource> WithNoManagedIdentity(
        this IResourceBuilder<AzureSandboxGroupResource> builder)
    {
        // ...
    }
}
```

## Parameters

- `builder` (`IResourceBuilder<AzureSandboxGroupResource>`)
  The sandbox group resource builder.

## Returns

`IResourceBuilder<AzureSandboxGroupResource>` -- The resource builder.

## Remarks

Workload identities requested by individual compute resources are added to the sandbox group during deployment preparation. Image pulls require a separate user-assigned identity. Aspire creates one by default for new groups; callers can select one with `WithAcrPullIdentity` and must do so for existing groups.

## ATS metadata

### ATS export

- Available to Polyglot AppHosts through the Aspire Type System.

<a id="withsystemassignedidentity"></a>
<a id="withsystemassignedidentity-iresourcebuilder-azuresandboxgroupresource"></a>

## WithSystemAssignedIdentity(IResourceBuilder<AzureSandboxGroupResource>)

- Name: `WithSystemAssignedIdentity(IResourceBuilder<AzureSandboxGroupResource>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<AzureSandboxGroupResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs#L242-L246)

Configures a system-assigned managed identity for sandbox workloads.

```csharp
public static class AzureSandboxesExtensions
{
    public static IResourceBuilder<AzureSandboxGroupResource> WithSystemAssignedIdentity(
        this IResourceBuilder<AzureSandboxGroupResource> builder)
    {
        // ...
    }
}
```

## Parameters

- `builder` (`IResourceBuilder<AzureSandboxGroupResource>`)
  The sandbox group resource builder.

## Returns

`IResourceBuilder<AzureSandboxGroupResource>` -- The resource builder.

## Remarks

Image pulls require a separate user-assigned identity. Aspire creates one by default for new groups; callers can select one with `WithAcrPullIdentity` and must do so for existing groups. Workload identities requested by individual compute resources may add more user-assigned identities.

## ATS metadata

### ATS export

- Available to Polyglot AppHosts through the Aspire Type System.

<a id="withuserassignedidentity"></a>
<a id="withuserassignedidentity-iresourcebuilder-azuresandboxgroupresource-iresourcebuilder-azureuserassignedidentityresource"></a>

## WithUserAssignedIdentity(IResourceBuilder<AzureSandboxGroupResource>, IResourceBuilder<AzureUserAssignedIdentityResource>)

- Name: `WithUserAssignedIdentity(IResourceBuilder<AzureSandboxGroupResource>, IResourceBuilder<AzureUserAssignedIdentityResource>)`
- Modifiers: `extension`
- Returns: `IResourceBuilder<AzureSandboxGroupResource>`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/f4c27f2d43ddc1cacd0dd083b30d1fea1cee7a62/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs#L265-L269)

Adds a user-assigned managed identity for sandbox workloads.

```csharp
public static class AzureSandboxesExtensions
{
    public static IResourceBuilder<AzureSandboxGroupResource> WithUserAssignedIdentity(
        this IResourceBuilder<AzureSandboxGroupResource> builder,
        IResourceBuilder<AzureUserAssignedIdentityResource> identity)
    {
        // ...
    }
}
```

## Parameters

- `builder` (`IResourceBuilder<AzureSandboxGroupResource>`)
  The sandbox group resource builder.
- `identity` (`IResourceBuilder<AzureUserAssignedIdentityResource>`)
  The user-assigned managed identity resource.

## Returns

`IResourceBuilder<AzureSandboxGroupResource>` -- The resource builder.

## Remarks

Image pulls require a separate user-assigned identity. Aspire creates one by default for new groups; callers can select one with `WithAcrPullIdentity` and must do so for existing groups.

## ATS metadata

### ATS export

- Available to Polyglot AppHosts through the Aspire Type System.