Azure Managed Redis fails to provision

[eerhardt]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

When trying

var cache = builder.AddAzureManagedRedis("cache");

And running or deploying the app, I get this failure:

cache-mqauoglj7udni","message":"'properties.publicNetworkAccess' is required in API version 2025-07-01."

Expected Behavior

The redis cache should provision correctly.

Steps To Reproduce

See above - just F5 an apphost with builder.AddAzureManagedRedis("cache")

Exceptions (if any)

{"error":{"code":"InvalidTemplateDeployment","message":"The template deployment 'cache' is not valid according to the validation procedure. The tracking id is '0e82e756-19bd-4ef1-88fc-6348f5d75350'. See inner errors for details.","details":[{"code":"BadRequest","target":"/subscriptions/b1d52bec-c8f1-4205-9399-473de1c34b90/resourceGroups/rg-sebros-azureconnections/providers/Microsoft.Cache/redisEnterprise/cache-mqauoglj7udni","message":"'properties.publicNetworkAccess' is required in API version 2025-07-01."}]}}

.NET Version info

No response

Anything else?

No response

[eerhardt]

We need to set publicNetworkAccess in

aspire/src/Aspire.Hosting.Azure.Redis/AzureManagedRedisExtensions.cs

Lines 188 to 206 in 2fc1605

	var cluster = new RedisEnterpriseCluster(infrastructure.AspireResource.GetBicepIdentifier())
	{
	Sku = new RedisEnterpriseSku
	{
	Name = RedisEnterpriseSkuName.BalancedB0
	},
	MinimumTlsVersion = RedisEnterpriseTlsVersion.Tls1_2
	};
	infra.Add(cluster);
	infra.Add(new RedisEnterpriseDatabase(cluster.BicepIdentifier + "_default")
	{
	Name = "default",
	Parent = cluster,
	Port = 10000,
	AccessKeysAuthentication = redisResource.UseAccessKeyAuthentication ?
	AccessKeysAuthentication.Enabled :
	AccessKeysAuthentication.Disabled
	});

[eerhardt]

@philon-msft @CawaMS - why is this property required with the latest version?

[philon-msft]

There's an Azure Policy applied to MS internal subs that requires publicNetworkAccess to be disabled on all resources that support it. When deploying using a recent Redis apiVersion that includes this property, it must be set to false.
But I believe it's not required on subs that don't have the Policy applied.

[eerhardt]

BadRequest: 'properties.publicNetworkAccess' is required in API
version 2025-07-01.

I still get this error even if I'm not using an MS internal sub. I get it when using my MSDN account. If I open the bicep file:

I get a static analysis error that this property must be set.

The problem with not having a default is that there is no way to tell if someone explicitly set it to true/false because they wanted it, or if it was defaulted to true/false.

With Azure.Provisioning, we can create InfrastructureResolvers that change the defaults to false. But the issue is that the resolvers run at the end, so if an application explicitly wants to set it to true, the InfrastructureResolver is going to come through and set it to false. But if there was a default (i.e. nothing explicitly set), the resolver could detect that and only set it to false if the value hadn't already been set.