Unable to provision Application Gateway for Containers

Bart Vreeken 25 Reputation points
2026-04-29T14:28:04.7+00:00

I am trying to deploy Application Gateway for Containers (AGC) in Azure (West Europe), both via Terraform and via the Azure Portal, but I consistently run into an error during provisioning.

Scenario

  • AKS cluster already exists and is properly configured (Workload Identity + OIDC enabled)
  • A dedicated subnet is created for AGC:
    • Address space: /24
    • Delegation: Microsoft.ServiceNetworking/trafficControllers
    • No other resources in the subnet
    • Resource providers such as Microsoft.ServiceNetworking, Microsoft.Network, and Microsoft.ContainerService are registered

    Problem

    When I try to create AGC via Terraform (azurerm_application_load_balancer + subnet association), or create AGC via the Azure Portal (including frontend + subnet association) provisioning fails. I get the following error from TF:
 Traffic Controller Name: "dev-weu-agc"): polling after CreateOrUpdate: polling failed: the Azure API returned the following error:
│
│ Status: "InternalServerError"
│ Code: ""
│ Message: "Internal Server Error"
│ Activity Id: ""
│
│ ---
│
│ API Response:
│
│ ----[start]----
│ {
│   "error": {
│     "code": "InternalServerError",
│     "message": "Internal Server Error"
│   },
│   "status": "Failed"
│ }
│ -----[end]-----

In the Azure Portal this shows a similar generic error (Activity logs):

"statusMessage": "{\"status\":\"Failed\",\"error\":{\"code\":\"ResourceOperationFailure\",\"message\":\"The resource operation completed with terminal provisioning state 'Failed'.\",\"details\":[{\"code\":\"InternalServerError\",\"message\":\"Internal Server Error\"}]}}"

Observations

  • The error occurs both via Terraform and Portal
  • The AGC parent resource never reaches Succeeded state
  • Subnet appears correctly configured and empty
  • Recreating the resource with a new name does not resolve the issue

Question: What else can I check? It there a way to find the root cause for this 'Internal Server Error'?

Removed PII

Azure Application Gateway
Azure Application Gateway

An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.

0 comments

Answer accepted by question author

Ravi Varma Mudduluru 12,535 Reputation points Microsoft External Staff Moderator
2026-04-29T15:09:16.4066667+00:00

Hello @ Bart Vreeken

Thank you for reaching out to Microsoft Q&A.

Thanks for providing the detailed scenario and error details. The generic InternalServerError during provisioning of Application Gateway for Containers (AGC) is unfortunately quite common and usually occurs deep in the data-plane when Azure tries to inject the managed proxies into the delegated subnet.

Double-checking:

  • Confirm the subnet is empty (no other resources, no NSG conflicts) and correctly delegated to Microsoft.ServiceNetworking/trafficControllers.
  • Ensure your AKS cluster uses Azure CNI (not Kubenet) and resides in the same Virtual Network as the AGC subnet.
  • Verify that the ALB Controller is installed correctly in the cluster and that the managed identity has the necessary permissions (at minimum Network Contributor on the VNet/subnet).
  • Make sure all required resource providers are registered: Microsoft.ServiceNetworking, Microsoft.Network, and Microsoft.ContainerService.

Recommended next steps:

  1. Clean up completely — Delete the failed Traffic Controller resource, the subnet association, and any lingering resources in the Failed state.
  2. Wait a few minutes, then try recreating it using Azure CLI instead of Terraform or the Portal. CLI often surfaces slightly better diagnostic. Then create the association and frontend separately.
  3. If it still fails, retry after 30–60 minutes. These errors can sometimes be transient on the service side, especially during subnet association.

Microsoft Documentation:

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alex Burlachenko 25,030 Reputation points MVP Volunteer Moderator
    2026-04-30T07:23:13.6433333+00:00

    Bart Vreeken hello & thx for join me here at Q&A portal,

    Bart, validate subnet delegation, Azure CNI, identity roles, then treat it as backend provisioning issue if portal also fails.

    If it fails from both Terraform and portal with plain InternalServerError, this is usually service-side provisioning failure, but check these AGC-specific things first. AGC association subnet must be dedicated, empty, in same region, and delegated to Microsoft.ServiceNetworking/trafficControllers; docs also state association subnet mapping is 1:1 and currently only one association is supported. AKS side matters too: cluster should be Azure CNI, not kubenet, AGC subnet should be reachable from the cluster VNet and ALB Controller identity needs proper rights, especially AppGw for Containers Configuration Manager plus network permissions; docs note this role has data actions that Owner/Contributor alone dont cover.

    If all that is correct and the parent AGC resource itself never reaches Succeeded, then this is below Terraform and below ALB Controller coz portal fails too. At that point check Activity Log JSON for hidden details and try creating AGC in a brand-new VNet/subnet in same region.... if clean VNet also fails, open ticket with correlation/activity IDs and ask them to inspect Microsoft.ServiceNetworking/trafficControllers provisioning in West Europe.

    rgds, Alex

    & 

    pls if my answer helps pls accept it.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.