Container Apps revision management supports changing active traffic versions. In this case, a Container App maintains one replica during idle periods. “Activate/route traffic to the previous healthy revision as supported” would not satisfy that requirement; the supported action is “A minimum replica setting of one keeps an instance active”. Minimum replicas set the floor below which scaling will not go.

Autoscaling depends on a valid event rule and credentials to read queue signals. In this case, a Container App maintains one replica during idle periods. “Queue scaler trigger, authentication and min/max replica settings” would not satisfy that requirement; the supported action is “A minimum replica setting of one keeps an instance active”. Minimum replicas set the floor below which scaling will not go.

An Always restart policy is unsuitable for run-once tasks. In this case, a Container App maintains one replica during idle periods. “The container group's restart policy” would not satisfy that requirement; the supported action is “A minimum replica setting of one keeps an instance active”. Minimum replicas set the floor below which scaling will not go.

Successful authentication cannot make a blocked endpoint reachable. In this case, an ACI job must execute a task once and exit successfully rather than restart forever. “Network routing, firewall rules and registry DNS resolution” would not satisfy that requirement; the supported action is “Use a non-restarting policy such as Never where appropriate”. ACI restart policy controls whether exited containers are restarted.

Container deployment depends on both image authorization and endpoint reachability. In this case, an ACI job must execute a task once and exit successfully rather than restart forever. “Registry access, private DNS and supported container networking together” would not satisfy that requirement; the supported action is “Use a non-restarting policy such as Never where appropriate”. ACI restart policy controls whether exited containers are restarted.

Minimum replicas set the floor below which scaling will not go. In this case, an ACI job must execute a task once and exit successfully rather than restart forever. “A minimum replica setting of one keeps an instance active” would not satisfy that requirement; the supported action is “Use a non-restarting policy such as Never where appropriate”. ACI restart policy controls whether exited containers are restarted.

Successful authentication cannot make a blocked endpoint reachable. In this case, a batch ACI container completes then restarts repeatedly. “Network routing, firewall rules and registry DNS resolution” would not satisfy that requirement; the supported action is “The container group's restart policy”. An Always restart policy is unsuitable for run-once tasks.

Container deployment depends on both image authorization and endpoint reachability. In this case, a batch ACI container completes then restarts repeatedly. “Registry access, private DNS and supported container networking together” would not satisfy that requirement; the supported action is “The container group's restart policy”. An Always restart policy is unsuitable for run-once tasks.

Minimum replicas set the floor below which scaling will not go. In this case, a batch ACI container completes then restarts repeatedly. “A minimum replica setting of one keeps an instance active” would not satisfy that requirement; the supported action is “The container group's restart policy”. An Always restart policy is unsuitable for run-once tasks.

ACR is the managed image repository; scanning and policy are integrated or configured separately. In this case, a container workload needs a private registry image and DNS resolution inside a VNet. “Azure Container Registry with a suitable security and lifecycle strategy” would not satisfy that requirement; the supported action is “Registry access, private DNS and supported container networking together”. Container deployment depends on both image authorization and endpoint reachability.

The managed environment must reach the private database over allowed network paths. In this case, a container workload needs a private registry image and DNS resolution inside a VNet. “A supported environment VNet integration and private DNS path” would not satisfy that requirement; the supported action is “Registry access, private DNS and supported container networking together”. Container deployment depends on both image authorization and endpoint reachability.

An Always restart policy is unsuitable for run-once tasks. In this case, a container workload needs a private registry image and DNS resolution inside a VNet. “The container group's restart policy” would not satisfy that requirement; the supported action is “Registry access, private DNS and supported container networking together”. Container deployment depends on both image authorization and endpoint reachability.

An Always restart policy is unsuitable for run-once tasks. In this case, an ACI container has credentials but times out pulling a private image. “The container group's restart policy” would not satisfy that requirement; the supported action is “Network routing, firewall rules and registry DNS resolution”. Successful authentication cannot make a blocked endpoint reachable.

ACR is the managed image repository; scanning and policy are integrated or configured separately. In this case, an ACI container has credentials but times out pulling a private image. “Azure Container Registry with a suitable security and lifecycle strategy” would not satisfy that requirement; the supported action is “Network routing, firewall rules and registry DNS resolution”. Successful authentication cannot make a blocked endpoint reachable.

ACI restart policy controls whether exited containers are restarted. In this case, an ACI container has credentials but times out pulling a private image. “Use a non-restarting policy such as Never where appropriate” would not satisfy that requirement; the supported action is “Network routing, firewall rules and registry DNS resolution”. Successful authentication cannot make a blocked endpoint reachable.

Container deployment depends on both image authorization and endpoint reachability. In this case, a team needs a central registry with automated security scanning and artifact governance. “Registry access, private DNS and supported container networking together” would not satisfy that requirement; the supported action is “Azure Container Registry with a suitable security and lifecycle strategy”. ACR is the managed image repository; scanning and policy are integrated or configured separately.

Successful authentication cannot make a blocked endpoint reachable. In this case, a team needs a central registry with automated security scanning and artifact governance. “Network routing, firewall rules and registry DNS resolution” would not satisfy that requirement; the supported action is “Azure Container Registry with a suitable security and lifecycle strategy”. ACR is the managed image repository; scanning and policy are integrated or configured separately.

The managed environment must reach the private database over allowed network paths. In this case, a team needs a central registry with automated security scanning and artifact governance. “A supported environment VNet integration and private DNS path” would not satisfy that requirement; the supported action is “Azure Container Registry with a suitable security and lifecycle strategy”. ACR is the managed image repository; scanning and policy are integrated or configured separately.

The managed environment must reach the private database over allowed network paths. In this case, a team assumes creating ACR alone automatically enforces signed-image validation everywhere. “A supported environment VNet integration and private DNS path” would not satisfy that requirement; the supported action is “Explicit image trust/policy enforcement for the target deployment path”. A registry is storage; supply-chain enforcement requires additional configuration.

Successful authentication cannot make a blocked endpoint reachable. In this case, a team assumes creating ACR alone automatically enforces signed-image validation everywhere. “Network routing, firewall rules and registry DNS resolution” would not satisfy that requirement; the supported action is “Explicit image trust/policy enforcement for the target deployment path”. A registry is storage; supply-chain enforcement requires additional configuration.

Container deployment depends on both image authorization and endpoint reachability. In this case, a team assumes creating ACR alone automatically enforces signed-image validation everywhere. “Registry access, private DNS and supported container networking together” would not satisfy that requirement; the supported action is “Explicit image trust/policy enforcement for the target deployment path”. A registry is storage; supply-chain enforcement requires additional configuration.

Container deployment depends on both image authorization and endpoint reachability. In this case, a Container Apps environment needs controlled outbound connectivity to a database private endpoint. “Registry access, private DNS and supported container networking together” would not satisfy that requirement; the supported action is “A supported environment VNet integration and private DNS path”. The managed environment must reach the private database over allowed network paths.

A registry is storage; supply-chain enforcement requires additional configuration. In this case, a Container Apps environment needs controlled outbound connectivity to a database private endpoint. “Explicit image trust/policy enforcement for the target deployment path” would not satisfy that requirement; the supported action is “A supported environment VNet integration and private DNS path”. The managed environment must reach the private database over allowed network paths.

ACR is the managed image repository; scanning and policy are integrated or configured separately. In this case, a Container Apps environment needs controlled outbound connectivity to a database private endpoint. “Azure Container Registry with a suitable security and lifecycle strategy” would not satisfy that requirement; the supported action is “A supported environment VNet integration and private DNS path”. The managed environment must reach the private database over allowed network paths.

Container App revisions bind to their defined image versions and settings. In this case, a container app has private DB credentials but cannot resolve the DB host. “The active revision's container image configuration” would not satisfy that requirement; the supported action is “Private DNS and network integration rather than only database authentication”. Credentials do not solve a missing route or DNS name resolution.

Container deployment depends on both image authorization and endpoint reachability. In this case, a container app has private DB credentials but cannot resolve the DB host. “Registry access, private DNS and supported container networking together” would not satisfy that requirement; the supported action is “Private DNS and network integration rather than only database authentication”. Credentials do not solve a missing route or DNS name resolution.

ACR is the managed image repository; scanning and policy are integrated or configured separately. In this case, a container app has private DB credentials but cannot resolve the DB host. “Azure Container Registry with a suitable security and lifecycle strategy” would not satisfy that requirement; the supported action is “Private DNS and network integration rather than only database authentication”. Credentials do not solve a missing route or DNS name resolution.

Credentials do not solve a missing route or DNS name resolution. In this case, a team must inspect which image version is deployed in a running Container App. “Private DNS and network integration rather than only database authentication” would not satisfy that requirement; the supported action is “The active revision's container image configuration”. Container App revisions bind to their defined image versions and settings.

The managed environment must reach the private database over allowed network paths. In this case, a team must inspect which image version is deployed in a running Container App. “A supported environment VNet integration and private DNS path” would not satisfy that requirement; the supported action is “The active revision's container image configuration”. Container App revisions bind to their defined image versions and settings.

A registry is storage; supply-chain enforcement requires additional configuration. In this case, a team must inspect which image version is deployed in a running Container App. “Explicit image trust/policy enforcement for the target deployment path” would not satisfy that requirement; the supported action is “The active revision's container image configuration”. Container App revisions bind to their defined image versions and settings.

Credentials do not solve a missing route or DNS name resolution. In this case, an engineer checks only the ACR latest tag and claims production is on that build. “Private DNS and network integration rather than only database authentication” would not satisfy that requirement; the supported action is “Deployment revisions may pin an older digest or tag”. Registry state alone does not prove which image a running workload uses.

The managed environment must reach the private database over allowed network paths. In this case, an engineer checks only the ACR latest tag and claims production is on that build. “A supported environment VNet integration and private DNS path” would not satisfy that requirement; the supported action is “Deployment revisions may pin an older digest or tag”. Registry state alone does not prove which image a running workload uses.

A registry is storage; supply-chain enforcement requires additional configuration. In this case, an engineer checks only the ACR latest tag and claims production is on that build. “Explicit image trust/policy enforcement for the target deployment path” would not satisfy that requirement; the supported action is “Deployment revisions may pin an older digest or tag”. Registry state alone does not prove which image a running workload uses.