azure-deploy

Confirm the deployment plan exists with Validated status, complete the pre-deploy checklist to verify subscription and location, then run azd provision followed by azd deploy. For Container Apps using ACR with managed identity, verify AcrPull role propagation between the two commands.

azd up combines provisioning and deployment in one step, while azd deploy only pushes application code to existing infrastructure. For Container Apps pulling from ACR with managed identity, use azd provision and azd deploy separately so the AcrPull role has time to propagate.

Yes, the Terraform recipe supports terraform plan and terraform apply with variable files or TF_VAR environment variables. Note that azd does not interpolate Go-style {{ .Env.* }} templates in .tfvars.json files, so use ${VAR} syntax instead.

The timeout occurs because the AcrPull role assignment for the Container App's managed identity has not propagated yet, which can take one to five minutes. Verify the role exists with az role assignment list, wait for propagation, then retry azd deploy.

Do not use it when creating a new application or generating infrastructure code, since it only executes deployments for already-prepared projects. Use azure-prepare to scaffold applications and azure-validate to verify the plan before deploying.

The error happens when Bicep templates hardcode principalType 'User' but the deploying identity is a service principal. Set allowUserIdentityPrincipal to false in the storageEndpointConfig variable in infra/main.bicep rather than clearing AZURE_PRINCIPAL_ID.