---
cuppy_hub: azure
cuppy_path: reference/container-apps/apps-ingress-and-scale.md
cuppy_section: docs
cuppy_doc: H8X2-B6V7
cuppy_doc_uuid: 3ea4ee87-e0ea-426f-bb5d-c38da5d63fc7
cuppy_permalink: https://cuppy.io/azure/d/H8X2-B6V7
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/azure/docs/reference/container-apps/apps-ingress-and-scale
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: a665211913a78761d8b79fd5182d2fc59e21e55aa9e822be8431409705011c23
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Container Apps — environments, ingress, revisions, scale

## Environments

| Type | Status | VNet subnet |
|---|---|---|
| **Workload profiles** (v2) | The default; Consumption and Dedicated profiles | `/27` or larger, **delegated to `Microsoft.App/environments`**. Supports user-defined routes, NAT gateway egress and private endpoints |
| Consumption-only (v1) | Legacy | `/23` or larger, **not delegated** to anything. No UDRs, NAT gateway or custom egress |

An environment created with `--internal-only` has no public endpoint: it's reachable only through an internal load balancer in your VNet. Subnet planning and DNS for internal environments: networking family.

## Ingress

Two levels decide who can reach an app. The **environment** is external or internal; the **app's ingress** is external ("accepting traffic from anywhere", which on an internal environment means the VNet, not the internet) or internal (other apps in the same environment only).

| Property | Default and rules |
|---|---|
| `external` | `false` |
| `targetPort` | The port the container listens on. HTTP ingress is always served on 443. If unset with HTTP ingress, Container Apps scans listening ports and uses the only one it finds |
| `transport` | `auto` (HTTP/1 or HTTP/2), `http`, `http2`, `tcp` (with `exposedPort`, not 80 or 443) |
| `allowInsecure` | `false`: HTTP on 80 is redirected to HTTPS |
| `ipSecurityRestrictions`, `stickySessions.affinity` | Optional; affinity `none` by default |

## Revisions and scale

- **Single revision mode** (default): a new revision replaces the old one once it's ready, without downtime. **Multiple revision mode**: you choose activation and traffic weights; wait for readiness before shifting traffic. Changing `properties.template` (containers, images, scale rules, revision suffix) creates a revision; changing `properties.configuration` (secrets, ingress, traffic, registry credentials, revision mode) applies to all revisions without one. **New secret values need a revision restart** to be seen.
- **Scale limits:** `minReplicas` 0 (scale to zero) and `maxReplicas` 10 by default; up to 1,000. Rules are HTTP, TCP or custom (KEDA scalers); a custom rule needs the scaler's own auth (secret or identity) and network path. Set `minReplicas: 1` when cold starts matter.

## Default probes

With ingress enabled and no probes defined, TCP probes on the target port are added to the main container (not to sidecars or GPU profiles):

| Probe | Defaults |
|---|---|
| Startup | TCP, timeout 3 s, period 1 s, initial delay 1 s, failure threshold 240 |
| Liveness | TCP on the target port |
| Readiness | TCP, timeout 5 s, period 5 s, initial delay 3 s, failure threshold 48 |

A revision shows unhealthy when any replica fails readiness. For slow starts, define your own startup probe rather than stretching liveness. HTTP probes on ports 80 or 443 can confuse automatic port detection.

## Secrets and identity

- Secrets are name/value pairs referenced from environment variables as `secretref:<name>`. In production, store a **Key Vault reference** instead of the value (`keyVaultUrl` plus `identity`); the app's managed identity needs **Key Vault Secrets User**.
- **Pulling from Container Registry with an identity:** in `configuration.registries`, set `server` and `identity` (a user-assigned identity's resource ID, or `system`). `az containerapp create … --registry-identity <id>` tries to create the AcrPull assignment for you. Prefer a user-assigned identity with AcrPull granted **before** the first deployment (`patterns/github-actions-to-container-apps.md`).
- Calling other Azure services from the app: `DefaultAzureCredential` with `AZURE_CLIENT_ID` set to the user-assigned identity's client ID (`reference/azure-identity/credential-chain.md`).

Errors: `reference/container-apps/errors.md`. Function apps as container apps: `reference/functions/functions-on-container-apps.md`.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->