ACA dynamic sandbox: HTTP Deny logs 403, TCP PolicyDenied never appears with it

There is no documented, supported configuration that combines the 2026-02-01-preview HTTP policy model with the 2026-09-01-preview transportRules model and guarantees both http.denied and statefulTcp PolicyDenied records in one sandbox; continue tracking this as a preview API/service issue in microsoft/azure-container-apps#1877 rather than merging fields from the two contracts.^1^

What the documented behavior establishes

With traffic inspection set to Full:

• Deny rules are enforced.
• Non-HTTP traffic is blocked.
• With Partial, unmatched non-HTTP traffic is allowed.
• Rules are evaluated in list order, and the first matching rule wins; the default action applies only when no rule matches.^2^

Consequently, the raw TCP connection succeeding under Full does not match the documented behavior. However, the documentation does not define:

• transportRules;
• the relationship between the two preview API versions;
• http.denied or statefulTcp.connections as a stable diagnostic contract;
• whether every blocked non-HTTP connection must generate a PolicyDenied row;
• a payload that combines both preview policy representations.

The current public issue matches the affected HTTP/TCP diagnostic surfaces and remains the appropriate public escalation record.^1^

Recommended next steps

1. Keep two minimal reproductions attached to issue #1877.
   • Reproduction A: 2026-02-01-preview, Full, default Deny, and the example.com deny rule.
   • Reproduction B: 2026-09-01-preview, equivalent HTTP policy plus the TCP deny rule.
   • Include the exact PUT request and redacted GET response for each resource.
2. Record evidence from fresh sandboxes. Policy updates apply only to subsequent requests; in-flight requests are not reevaluated.^2^
   • Create or update the policy.
   • Start a new HTTP request and a new TCP connection.
   • Record UTC timestamps, region, sandbox resource ID with subscription details removed, API version, response status, and returned correlation/request IDs.
   • Export the complete egressDecisions response rather than only the empty arrays.
3. Do not combine properties from the two preview payloads unless the complete schema for one API version explicitly declares all of them. A field accepted by one preview version does not establish that another version preserves it or uses the same diagnostics.
4. Use enforcement outcome as the security test, not log presence.
   • For Full, both HTTPS to the denied host and unmatched raw TCP should be blocked under the documented behavior.
   • Treat a missing diagnostic row separately from a connection that actually succeeds. The latter is the higher-severity policy-enforcement discrepancy.
5. Add the following matrix to the GitHub issue so the service team can distinguish serialization, enforcement, and telemetry failures:

A paid Azure technical support plan is required for technical support requests; subscription-management support does not substitute for product technical support.^3^ Until the preview contract or service behavior is updated, the requested single-sandbox combination cannot be asserted as available from the published documentation.

References

1. ACA Sandboxes egressDecisions empty under Enforced Deny + Full ... - GitHub
2. Egress policies and network controls for Azure Container Apps Sandboxes
3. Create an Azure support request for an Enterprise Agreement issue