I’ve successfully completed the tutorial for containerized functions on Azure Container Apps.

Now when I go to setup up Github Actions for continuous deployment from the container app in the Azure portal, I get an error like this:

Failed to set up continuous deployment with error: The client ‘{email-address}’ with object id ‘{user-uuid}’ has permission to perform action ‘Microsoft.Resources/deployments/write’ on scope ‘/subscriptions/{subscription-uuid}/resourcegroups/{strange-containerapp-resource group}/providers/Microsoft.Resources/deployments/Microsoft-Continuous-Deployment-cb0020a2-8aed’; however, the access is denied because of the deny assignment with name ‘{deny-assignment-uuid}’ and Id ‘{deny-assignment-uuid}’ at scope ‘/subscriptions/{subscription-uuid}/resourceGroups/{strange-containerapp-resource-group}’.

What is this “deny assignment” and why is it blocking me from setting up continuous deployment?

The container app itself is in a strange resource group, with a name like MyContainerappEnvironment_FunctionApps_{deny-assignment-uuid}. All the other resources created by following the tutorial are in the expected resource group AzureFunctionsContainers-rg, but not the container app itself!

If I try to move the container app to a different resource group, I get a similar “deny assignment” error.

What is this about? Are we not supposed to configure continuous deployment from within the container app itself? Help!