Container App Private DNS Check

Synopsis

Intended end result: Confirm Container Apps private endpoint DNS resolves through the correct regional private zone.

How this page gets you there: Inspect DNS zone group links, detect region mismatch, and remove stale zones only when safe.

The private DNS zone for Container Apps must match the actual deployment region. Validate the linked zone before assuming networking is correct.

RG="ai4gl-condor-uat-rg"
PE_NAME="ai4gl-condor-uat-pep-app"

az network private-endpoint dns-zone-group show --resource-group "$RG" --endpoint-name "$PE_NAME" --name default --query "privateDnsZoneConfigs[].{config:name,zoneId:privateDnsZoneId}" -o table

az network private-endpoint dns-zone-group show --resource-group "$RG" --endpoint-name "$PE_NAME" --name default --query "privateDnsZoneConfigs[].privateDnsZoneId" -o tsv

If the wrong regional zone was created, remove the stale zone only after confirming nothing else depends on it:

OLD_ZONE="privatelink.swedencentral.azurecontainerapps.io"

az network private-dns link vnet delete -g "$RG" -z "$OLD_ZONE" -n "ai4gl-condor-app-environment-link" --yes
az network private-dns zone delete -g "$RG" -n "$OLD_ZONE" --yes

Synopsis​

Synopsis