Microsoft Solutions Partner — Container Apps · 11,000+ engagements

Azure Container Apps Enterprise Guide (2026)

How enterprises run Azure Container Apps in production — KEDA scale-to-zero, Dapr sidecars, managed identity, VNET integration, and the EPC Group five-phase accelerator. Authored by a Microsoft Solutions Partner founded in 1997.

Book a Container Apps briefing Call 888-381-9725

What is Azure Container Apps and how do enterprises run it in production? Azure Container Apps is the Microsoft serverless container platform — Kubernetes underneath, fully abstracted. Microsoft operates the control plane, node pools, image management, scaling, and upgrades; the customer owns only the container image and the manifest. Enterprises run Container Apps for microservices, event-driven workers, AI inference back-ends, background jobs, and Dapr-portable workloads — typically with KEDA scale-to-zero on the Consumption plan, Dapr sidecars for state and pub/sub, user-assigned managed identity for Azure resource access, internal VNET ingress for service-to-service traffic, and Defender for Cloud for posture and runtime protection. EPC Group delivers Container Apps through a five-phase Assess, Foundation, Platform, Workload, Operate accelerator that produces a production-grade estate in eight to sixteen weeks, fixed-fee between $100K and $400K.

Azure Container Apps is the Microsoft serverless container platform — Kubernetes is the substrate, fully abstracted. Microsoft operates the control plane, node management, image lifecycle, and upgrades; the customer owns only the container image and the manifest. The 2026 reference architecture pairs KEDA-based scale-to-zero, Dapr sidecars, user-assigned managed identity, internal VNET ingress, and Defender for Cloud. Container Apps is the correct surface for greenfield microservices, event-driven workers, AI inference back-ends, background jobs, and Dapr-portable workloads where the team does not need (or want) Kubernetes operations. EPC Group delivers a fixed-fee five-phase accelerator between $100K and $400K.

Key Facts

Azure Container Apps abstracts Kubernetes — Microsoft operates the control plane, nodes, image management, and scaling
KEDA-based scale-to-zero with HTTP, queue, event, and custom-metric scalers — per-second billing on Consumption plan
Built-in Dapr integration — state management, pub/sub, bindings, service invocation, secrets, workflow
User-assigned managed identity is the production identity model — no client secrets, no service principals managed by hand
Dedicated workload profiles (GA 2024, expanded 2025) deliver memory-optimized and GPU-enabled capacity for AI inference
Multi-revision blue/green and canary deployment is a native platform property — no Argo Rollouts install required
Container Apps Jobs (GA 2024) covers one-shot, scheduled, and event-triggered background workloads — replaces many AKS CronJobs
EPC Group five-phase ACA Accelerator delivers full activation in 8 to 16 weeks as a fixed fee — Microsoft Solutions Partner founded in 1997

ACA vs AKS vs Functions vs App Service — the decision matrix

Container Apps is one of four compute surfaces Microsoft offers for application workloads. The right surface for any given workload depends on operational appetite, scale shape, sidecar requirements, and the cost model. EPC Group profiles every workload during the assessment phase and lands each on the surface that produces the best operational and economic outcome.

Capability	Container Apps	AKS	Functions	App Service
Compute abstraction	Serverless containers — Kubernetes underneath, fully abstracted	Full Kubernetes API — customer-managed node pools	Serverless functions — language runtimes, no container surface required	PaaS web apps — code or container, App Service Plan-bound
Scale model	KEDA-based scale-to-zero, HTTP, queue, custom metrics — per-second billing	HPA + Cluster Autoscaler + Karpenter — node-level scale	Event-driven trigger model — short-lived per invocation	Plan-based scale or Premium auto-scale — instances, not pods
Operational surface	No kubectl, no nodes, no etcd — Microsoft operates the platform	Full Kubernetes operations — control plane is managed, nodes are not	No container or runtime ops — function code only	App Service Plan + deployment slots — minimal ops
Best fit	Microservices, event-driven workers, AI inference, Dapr workloads, background jobs	Tier-zero platform, stateful workloads, custom networking, service mesh, GPU pools	Short-duration event handlers, glue logic, single-language workloads	Traditional web apps, line-of-business APIs, WordPress-style stacks
Sidecars / mesh	Built-in Dapr integration — state, pub/sub, bindings, service invocation	Istio (managed add-on), Linkerd, Open Service Mesh, Dapr by install	Not applicable	Not applicable
Pricing model	Consumption (per-second vCPU + memory) or Dedicated workload profiles	Control-plane tier + node-pool compute (VMs, Spot, RI/SP)	Consumption, Premium, or App Service Plan	App Service Plan — fixed per-hour

Container Apps coexists with AKS in the same enterprise — Container Apps for line-of-business microservices and event-driven workloads, AKS for tier-zero platforms and workloads that need Kubernetes-specific primitives. The full serverless functions story sits at Azure Functions enterprise guide.

Six Container Apps enterprise patterns

Every Container Apps engagement composes from one or more of these patterns. EPC Group sequences the build against business priority, not against the platform feature catalog.

Pattern 1 — Microservices estate without Kubernetes operations

Container Apps is the correct surface for greenfield microservices estates where the team wants Kubernetes-class capabilities (sidecars, internal service-to-service traffic, event-driven scaling) without owning a Kubernetes cluster. Each microservice is a Container App in a shared environment that provides the VNET, Log Analytics workspace, Dapr control plane, and managed certificates. Internal ingress keeps service-to-service traffic on the environment’s internal DNS while external ingress exposes the customer-facing edge through HTTPS with managed cert rotation. EPC Group ships a reference repo structure that pairs Container Apps with Azure Container Registry geo-replication, Bicep-defined environments, and a GitHub Actions or Azure DevOps deployment pipeline so the platform team productizes the surface for application teams.

Pattern 2 — Event-driven scale through KEDA — queues, topics, streams

Container Apps is built on KEDA — Kubernetes-Event-Driven-Autoscaling — as the native scaling engine. Workloads scale on Azure Service Bus queue depth, Event Hub partitions, Storage Queues, Kafka consumer lag, Azure Cosmos DB change feed throughput, or any of fifty-plus KEDA scalers. Scale-to-zero is the default for non-HTTP workloads, so a queue-consumer Container App incurs no cost while idle and ramps to N replicas the moment the queue grows. EPC Group pairs the pattern with Azure Service Bus topics, dead-letter handling, and exactly-once message processing via duplicate detection to deliver a production-grade event mesh on top of Container Apps that is more economical than the equivalent AKS pattern for the long tail of low-volume, bursty workloads.

Pattern 3 — Dapr sidecar workloads — portable building blocks

Dapr is the distributed application runtime that Container Apps treats as a first-class citizen — the Dapr sidecar is injected by toggling a property on the Container App, not by installing an operator. Dapr building blocks — state management, pub/sub, service invocation, bindings, secrets, configuration, workflow — decouple application code from cloud-specific SDKs. The Container App calls a local Dapr HTTP or gRPC endpoint; Dapr brokers to Azure Service Bus, Cosmos DB, Key Vault, Storage, or any pluggable component. The pattern is correct for portable workloads that may run in Container Apps today and AKS or Arc-enabled Kubernetes tomorrow, for polyglot microservices estates where the SDK-per-language overhead is significant, and for workflows that benefit from Dapr Workflow durability semantics without standing up a full orchestrator.

Pattern 4 — AI inference workloads on Dedicated workload profiles

Container Apps Dedicated workload profiles (GA in 2024 and significantly expanded in 2025) deliver consumption-style operations on dedicated capacity — including memory-optimized and GPU-enabled profiles for AI inference. The pattern: a vLLM, Triton, Ollama, or Azure ML inference container deployed as a Container App on a GPU workload profile, scaled by KEDA HTTP scaler with target concurrent requests per replica, fronted by Azure Front Door or API Management for traffic management. The platform handles node provisioning, image management, and scale. For inference workloads that do not need Karpenter-class flexibility, Container Apps removes the AKS operational surface while keeping GPU economics tractable. EPC Group has shipped this pattern for retrieval-augmented generation back-ends, embedding-generation services, and self-hosted small-model inference behind a Container App ingress.

Pattern 5 — Background workers, jobs, and scheduled tasks

Container Apps Jobs (GA 2024) extend the Container Apps platform to one-shot and scheduled workloads. Three job trigger types — manual, schedule (cron), and event (queue or Event Hub depth) — cover the vast majority of background processing. Each job execution is a separate container instance that runs to completion and exits. The pattern is correct for nightly batch processing, scheduled report generation, event-driven file processing, and ad-hoc data backfills that previously ran on a virtual machine or in an AKS CronJob. KEDA scaler-backed jobs scale parallel executions on queue depth — the queue grows, ten executions spin up in parallel, drain, and exit. EPC Group standardizes on Container Apps Jobs for the entire background-workload tier in greenfield estates because the operational surface is minimal and the cost model is per-second of execution.

Pattern 6 — Multi-revision blue/green and canary deployments

Container Apps native multi-revision mode is the deployment surface that makes blue/green and canary patterns trivial. Each deployment creates a new immutable revision; the Container App routes traffic across revisions by weighted split. A 95/5 weighted split routes 95% of traffic to the stable revision and 5% to a canary; instrument both with Azure Monitor, validate the canary, and shift the weight to 100% — or 0% to roll back. Revision label-based routing supports header-based or cookie-based routing for shadow testing and dark launches. EPC Group pairs the pattern with deployment safeguards in the CI/CD pipeline — synthetic transaction monitoring, automated rollback on SLO breach — to deliver progressive delivery the audit team can trace without the Argo Rollouts operator install AKS requires.

KEDA scale-to-zero

KEDA scaling — HTTP, queues, custom metrics, and scale-to-zero economics

KEDA is the scaling engine that makes Container Apps economically distinct from the rest of the Microsoft compute catalog. The platform watches external signals — HTTP request rate, queue depth, event-stream lag, custom Prometheus metrics — and adjusts replica count to match. When the signal drops to zero, replicas drop to zero and compute billing stops. The economics matter most for variable-demand workloads where always-on compute wastes 60% to 90% of capacity outside peak.

HTTP scaling — concurrent requests per replica

The HTTP scaler is the default for any externally addressable Container App. It scales on concurrent request count per replica with configurable target concurrency, min-replicas, and max-replicas. Min-replicas zero unlocks true scale-to-zero — the Container App cold-starts on the first request, which typically lands sub-second for small images. For latency-sensitive workloads min-replicas is set to one or two to keep a warm replica always available. The pattern routinely lands at 60% to 85% lower compute spend than an always-on App Service Plan for the long tail of low-traffic APIs and internal tools.

Configurable concurrent-requests-per-replica target — typically 10 to 100 depending on workload profile
Min-replicas 0 for scale-to-zero — cold start sub-second for small images, multi-second for large images
Max-replicas ceiling protects downstream dependencies (databases, third-party APIs) from runaway scale
Pairs with Azure Front Door or API Management for global traffic management and rate limiting

Queue and event scaling — Service Bus, Event Hubs, Storage, Kafka

For non-HTTP workloads, KEDA queue scalers are the dominant pattern. Azure Service Bus scalers scale on queue depth or topic-subscription backlog. Event Hubs scalers scale on partition lag and unprocessed-event count. Storage Queue scalers handle the lightweight Storage Queue surface. Kafka and Confluent scalers handle the Kafka ecosystem. The pattern unlocks elastic worker fleets that cost nothing while idle and scale linearly with queue depth — replacing the always-on consumer pool pattern that wastes 70% to 90% of compute outside peak.

Azure Service Bus — queue depth or topic-subscription unprocessed-message-count triggers
Event Hubs — partition lag and unprocessed-event count triggers with configurable thresholds
Azure Storage Queues — lightweight queue scaler for the Storage Queue ecosystem
Kafka, RabbitMQ, Cosmos DB change feed, Redis Stream — fifty-plus pluggable scalers

Custom metrics scaling — Prometheus, Azure Monitor, custom signals

When neither HTTP nor queue depth captures the workload reality, custom-metric scalers carry the load. Prometheus scalers consume any Prometheus query as a scale signal — request-per-second from an APM, in-flight inference token count, GPU memory utilization, or any business metric exposed by the application. Azure Monitor scalers consume any Azure Monitor metric — App Insights custom events, Cosmos DB RU consumption, Log Analytics queries. EPC Group uses the pattern for AI inference workloads where token throughput is the correct scale signal rather than HTTP request count, and for workflow engines where pending-task count is the right business signal.

Prometheus query as scale signal — any metric exposed by the application or sidecar
Azure Monitor metric scaler — App Insights, Cosmos DB RU, Log Analytics queries
Workflow-driven scaling — pending-task count from a workflow engine as the scale signal
Composite scaling — multiple triggers AND/OR combined for production-grade decisioning

Scale-to-zero economics — where it pays and where it does not

Scale-to-zero is the headline economic feature. The math is straightforward — a Container App scaled to zero costs nothing for compute, only the per-environment fixed charges (Log Analytics, VNET data path). For low-traffic APIs (internal tools, partner integrations, low-volume webhooks) and bursty event-driven workloads (off-hours processing, weekend batch), the savings versus an always-on App Service Plan or AKS deployment routinely land at 60% to 90%. The break-even point — where always-on becomes cheaper than scale-to-zero — sits around 30% to 40% utilization. EPC Group profiles every workload during the assessment phase to land each on the correct compute surface.

Per-second billing on consumption profile — pay only for active compute, scaled to actual demand
Cold-start budget — sub-second for small images, multi-second for large images, design accordingly
Break-even with always-on at roughly 30% to 40% utilization — measure before you choose
Pairs with Front Door cached responses to absorb cold-start latency on the customer edge

Dapr sidecars

Dapr integration — state, pub/sub, bindings, service invocation

Dapr is the distributed application runtime built into Container Apps as a first-class toggle — no operator install, no controller management. The Container App talks to a local Dapr HTTP or gRPC endpoint for state, pub/sub, bindings, service invocation, secrets, and workflow; Dapr brokers to Azure Service Bus, Cosmos DB, Key Vault, Storage, and dozens of other components. The pattern decouples application code from cloud-specific SDKs — a real lever for polyglot estates and portability between Container Apps, AKS, and Arc-enabled Kubernetes.

State management — Cosmos DB, Redis, Storage, SQL

Dapr state management abstracts the state store behind a simple HTTP or gRPC API. The Container App calls a local Dapr endpoint to get or set state; Dapr brokers to the configured state component — Azure Cosmos DB for globally distributed scenarios, Azure Cache for Redis for low-latency hot state, Azure Table Storage for cost-sensitive workloads, Azure SQL for relational state. Application code does not import a Cosmos DB SDK; it speaks HTTP to the Dapr sidecar. The state store is swappable per environment — Cosmos in production, Redis in staging, in-memory in dev — without code changes.

Publish / subscribe — Service Bus, Event Hubs, Event Grid

Dapr pub/sub abstracts the message bus. The Container App publishes a typed message to a topic; subscribers register handlers. The pub/sub component routes to Azure Service Bus topics, Event Hubs, Event Grid, Kafka, Redis Streams, or any of the supported brokers. The pattern decouples publishers from subscribers without the SDK-per-broker overhead and enables the broker to be swapped without changing application code — a real lever for organizations migrating between brokers or running multi-broker estates.

Bindings — input and output to external systems

Dapr bindings provide event-driven input and pluggable output across a wide catalog of external systems — Azure Storage, Twilio, SendGrid, SMTP, HTTP, GraphQL, Kubernetes events, MQTT, and dozens more. An input binding triggers the Container App when an event arrives; an output binding invokes an external system without a per-system SDK. The pattern is most powerful for the long tail of integration scenarios where standing up a custom integration is more code than the workload itself warrants.

Service invocation — mTLS service-to-service calls

Dapr service invocation is the service-to-service call surface. Container App A invokes Container App B by app-id rather than by URL; Dapr handles discovery, mutual TLS, retry, and tracing through the sidecar. The pattern delivers mesh-class capability — mTLS, retries, observability — without the operational surface of an actual service mesh, which makes it the correct fit for greenfield microservices on Container Apps that do not need full Istio.

Security & identity

Five controls that make Container Apps auditor-ready for HIPAA, FedRAMP, and CMMC

Production Container Apps security stands on five controls that ship natively in the Microsoft stack — managed identity for Azure resource access, Entra Workload ID for cross-cloud federation, VNET integration for network isolation, Defender for Cloud for posture and runtime, and Key Vault references for secrets. See the broader Defender for Cloud CNAPP guide and the Entra ID enterprise guide for the platform context.

Managed identity — system-assigned and user-assigned

Container Apps authenticate to Azure services through system-assigned or user-assigned managed identity. No client secrets stored in environment variables, no service principals managed by hand, no secret-rotation pipeline to maintain. The Container App fetches a token from the IMDS endpoint inside the sidecar and presents it to Azure SQL, Key Vault, Storage, Cosmos DB, Service Bus, or any Entra-aware Azure resource. User-assigned identities scale better for fleets of Container Apps sharing the same downstream permissions.

Microsoft Entra Workload ID federation

For workloads that must federate to non-Azure systems or to other Entra tenants, Workload ID federation maps the Container App identity to an Entra application. The pattern is the production identity model for cross-cloud federation, GitHub OIDC, and any scenario where the Container App must present an Entra token to a system Microsoft does not directly own. Replaces the legacy pattern of static client secrets shared between systems.

VNET integration — internal-only and external ingress

Container Apps environments are VNET-integrated by default in 2026 deployments. Internal-only environments expose no public IP; ingress is reachable only from inside the VNET or through Private Link. External environments add a public ingress while keeping internal service-to-service traffic on the environment’s internal DNS. The pattern pairs with Azure Firewall or NAT Gateway for egress control, Private Endpoints for downstream PaaS, and a hub-and-spoke topology so multiple Container Apps environments share a common security perimeter.

Microsoft Defender for Cloud — Container Apps coverage

Defender for Cloud now covers Container Apps with posture management, image vulnerability assessment through Defender for Containers, and Sentinel integration for runtime alerting. The pattern matches what AKS gets from Defender for Containers — registry scanning, posture findings against the Microsoft cloud security benchmark, and incident streaming into the SOC — without the Kubernetes operational surface. Combined with Azure Policy for Container Apps, the compliance team gets uniform enforcement and auditor-ready Resource Graph evidence.

Secrets — Key Vault references and rotation

Application secrets reference Azure Key Vault entries by URI; the Container App resolves the reference through managed identity at runtime. Secret rotation in Key Vault flows through to the Container App on the next replica creation without redeploying the image. EPC Group standardizes on Key Vault references for every secret beyond build-time configuration so the supply chain for production credentials is auditable, rotated, and never embedded in container images or revision manifests.

HIPAA

SOC 2

FedRAMP

FINRA

CMMC

GxP

Cost model

Consumption, Dedicated, and savings plans — the Container Apps cost model

The Container Apps cost model has two compute surfaces — Consumption (per-second vCPU and memory, scale-to-zero) and Dedicated workload profiles (per-node-hour on dedicated VM capacity). The right mix for any enterprise depends on workload shape — Consumption for the variable layer, Dedicated for the steady-state core. Secondary costs — Log Analytics ingestion, VNET data path, ingress egress — are tuned independently.

Consumption plan — per-second vCPU and memory

The Consumption plan bills per-second of active vCPU and GiB-second of active memory. A Container App scaled to zero costs zero compute; a Container App running one replica at 0.5 vCPU and 1 GiB costs the configured per-second rate for those resources. The economic story is strongest for workloads with variable demand — bursty event-driven workers, low-traffic internal APIs, scheduled jobs, and AI inference behind queue or HTTP scalers. EPC Group routinely lands greenfield microservice estates 40% to 70% below the equivalent App Service or AKS spend on Consumption.

Dedicated workload profiles — predictable steady-state

Dedicated workload profiles deliver Container Apps semantics on dedicated capacity — including general-purpose D-series, memory-optimized E-series, and GPU-enabled profiles. The billing model shifts to per-node-hour rather than per-second, which is more economical for workloads with high steady-state utilization. The pattern: Consumption for the variable layer, Dedicated for the always-on core. Both compute surfaces coexist in the same Container Apps environment, with workloads pinned to profile through a property — no application-code change.

Reservations and savings plans — Dedicated profile commitment

Dedicated workload profiles are eligible for Azure Compute Reservations and Savings Plans on the underlying VM capacity. For the steady-state core that runs 24x7 on Dedicated, a one or three-year savings plan typically lands 30% to 55% off pay-as-you-go pricing — the same lever used on AKS node pools and standalone VMs. The Consumption layer remains pay-as-you-go and elastic above the reserved floor.

Observability and ingress — the secondary cost drivers

Beyond compute, the dominant cost drivers are Log Analytics ingestion (logs and metrics), VNET data path, and ingress traffic egress. EPC Group tunes Log Analytics commitment tiers, applies log sampling and filtering at the Container App level, and routes high-cardinality telemetry through Azure Monitor managed Prometheus rather than Log Analytics where appropriate. Ingress egress costs are managed through Front Door caching and regional placement that keeps client-to-edge traffic on the lowest-cost path.

The EPC Group Azure Container Apps Accelerator — five phases, fixed fee

The accelerator anchors on The EPC Group Lifecycle — Assess, Foundation, Platform, Workload, Operate. Fixed-scope between $100,000 and $400,000 depending on environment count, workload count, regulatory scope, Dapr component depth, and AI inference workload load. Senior-architect led, no offshore handoff.

Phase 1 — Assess

Workload, cost, and platform-fit baseline in two weeks

Phase one inventories every workload candidate for Container Apps — greenfield microservices, event-driven workers, background jobs, AI inference back-ends, and migration candidates from App Service or virtual machines. EPC Group maps each to the correct compute surface — Container Apps, AKS, Functions, or App Service — based on workload profile, scale shape, and operational requirements. Deliverables: workload taxonomy, costed environment topology, accelerator scope.

Workload inventory and pattern classification — microservices, event-driven, AI inference, background, jobs
Container Apps vs AKS vs Functions vs App Service per-workload decision matrix
Costed environment topology — Consumption vs Dedicated profile mix, region, networking
Existing-estate posture review against the Container Apps reference architecture

Phase 2 — Foundation

Environment, networking, identity, and registry plane stood up

Phase two builds the Container Apps landing zone — Container Apps environments deployed into a hub-and-spoke VNET, Azure Container Registry geo-replicated, Key Vault, Log Analytics, Application Insights, and Microsoft Defender for Cloud enabled at subscription scope. Identity is wired through user-assigned managed identity for every Container App with a documented naming standard. Azure Policy initiatives apply uniformly at management-group scope.

Container Apps environments deployed across regions with internal and external ingress patterns
Hub VNET, Azure Firewall, Private DNS, Private Endpoints, ACR, Key Vault, Log Analytics provisioned
User-assigned managed identity standards published, Workload ID federation patterns documented
Defender for Cloud, Defender for Containers, and Sentinel data connectors enabled

Phase 3 — Platform

Dapr, KEDA, deployment pipeline, and platform services

Phase three configures the platform services that span every Container App — Dapr components for state, pub/sub, bindings, and secrets pointing to the right Azure resources; KEDA scaler templates for common workload classes; the GitHub Actions or Azure DevOps deployment pipeline with multi-revision deployment and approval gates; and the Bicep or Terraform infrastructure-as-code library that application teams consume.

Dapr components configured for Cosmos DB state, Service Bus pub/sub, Key Vault secrets, Storage bindings
KEDA scaler templates for HTTP, Service Bus, Event Hubs, custom metrics across workload classes
Deployment pipeline with multi-revision blue/green, canary, automated rollback, and synthetic monitoring
Bicep / Terraform module library for environments, Container Apps, and shared platform services

Phase 4 — Workload

Application onboarding and platform productization

Phase four onboards the first tranche of workloads. EPC Group runs a containerization pattern library — multi-stage Dockerfiles, distroless bases, ACR build tasks — and a self-service onboarding pattern so the platform team productizes the surface rather than handcrafting each workload. Observability ships through Application Insights, Log Analytics, and Azure Monitor managed Prometheus with workload-aligned dashboards.

First wave of workloads ported with a documented onboarding pattern reusable by application teams
Pod-equivalent practices applied per workload — resource limits, health probes, KEDA configuration, secrets
Application Insights + Log Analytics + managed Prometheus + Grafana with workload-aligned dashboards
DR runbook, chaos validation, and load testing executed before any workload enters production

Phase 5 — Operate

Day-two operations, FinOps, and continuous compliance

Phase five operationalizes the Container Apps estate. Quarterly FinOps reviews drive the Consumption vs Dedicated profile mix toward target cost efficiency. Defender for Cloud and Defender for Containers feed Sentinel for SOC investigation. Azure Policy compliance state is reported through Resource Graph to the compliance team. Platform upgrades to Container Apps base images, Dapr versions, and KEDA scalers are scheduled into documented maintenance windows with automated rollback if regressions appear.

Quarterly FinOps review across Consumption, Dedicated, reservations, and right-sizing
Defender for Cloud + Sentinel runbook for runtime threat investigation and incident response
Azure Policy for Container Apps compliance state reported via Resource Graph for auditor consumption
Platform upgrade cadence for base images, Dapr versions, and KEDA scalers with rollback safeguards

Why EPC Group leads enterprise Azure Container Apps deployments

1997

Founded · Microsoft consulting

70+

Fortune 500 clients

216+

M&A tenant consolidations

1.83 million

Users migrated

Microsoft Solutions Partner — Infrastructure & Digital App Innovation

Microsoft Solutions Partner with the Infrastructure (Azure) and Digital & App Innovation (Azure) designations covering Container Apps engagements end-to-end, plus four additional designations across Security, Data & AI, Modern Work, and Business Applications.

Four-time author for Microsoft Press and Sams

Founder Errin O’Connor has nearly three decades of Microsoft consulting leadership and is a four-time author for Microsoft Press and Sams across Power BI and SharePoint.

Fixed-fee accelerators

Every Container Apps engagement is fixed-fee with a costed roadmap and a named senior architect on-record from kickoff through go-live. No T&M overruns, no offshore handoff, no junior-analyst-led production cutover.

Compliance-native

EPC Group is compliance-native across HIPAA, SOC 2, FedRAMP, FINRA, CMMC, and GxP. Container Apps deployments ship with auditor-ready control matrices, Defender for Cloud HIPAA mappings, and Resource Graph evidence queries.

Frequently asked questions — Azure Container Apps

When should an enterprise pick Azure Container Apps over Azure Kubernetes Service?

Container Apps is the correct surface when the workload needs Kubernetes-class capabilities — sidecars, internal service-to-service traffic, event-driven scaling — but the team does not need (or want) Kubernetes operations. The platform handles control plane, node pools, image management, scaling, and upgrades; the application team owns only the container image and the manifest. AKS earns its operational cost when workloads need custom CNI configuration, specialized VM SKUs, GPU pools sized through Karpenter, service-mesh patterns beyond Dapr, stateful workloads requiring StatefulSet operators, multi-cluster orchestration through Fleet Manager, or platform-level operators the abstraction layer cannot expose. The decision rule EPC Group applies — start with Container Apps for greenfield event-driven microservices and Container Apps Jobs for background workloads; reach for AKS when the workload genuinely needs Kubernetes-specific primitives. The two coexist in the same enterprise without conflict — same Entra identity, same Defender posture, same Sentinel surface. Full Kubernetes coverage at /azure-kubernetes-service-aks-enterprise-2026.

How does KEDA scale-to-zero actually work, and when does it pay off?

KEDA — Kubernetes-Event-Driven-Autoscaling — is the scaling engine built into Container Apps. A KEDA scaler watches an external signal (HTTP request rate, Service Bus queue depth, Event Hub partition lag, custom Prometheus query) and adjusts the Container App replica count to match the signal. When the signal drops to zero — empty queue, no HTTP traffic — KEDA scales replicas to zero and compute billing stops. When the signal returns, KEDA scales the Container App back up; for HTTP workloads, the first request triggers a cold-start which lands sub-second for small images. The economic break-even with always-on compute sits around 30% to 40% utilization — below that, scale-to-zero is materially cheaper than App Service Plans or always-on AKS deployments. For variable-demand workloads (internal tools, partner APIs, off-hours batch processing, event-driven workers), savings of 60% to 90% versus always-on are routine. For high-utilization steady-state workloads, Dedicated workload profiles or AKS Reserved Instances are typically the better economic choice.

What is Dapr, and why does Microsoft bake it into Container Apps?

Dapr — the Distributed Application Runtime — is a CNCF-graduated project that delivers portable building blocks for microservices through a sidecar. The Container App talks to a local Dapr HTTP or gRPC endpoint for state management, pub/sub, service invocation, bindings, secrets, configuration, and workflow; Dapr brokers to the configured Azure (or non-Azure) component. Microsoft baked Dapr into Container Apps as a first-class toggle (no operator install required) because the building-block pattern lets enterprises decouple application code from cloud-specific SDKs — a real lever for portability between Container Apps, AKS, Arc-enabled Kubernetes, and even on-prem hosting. The pattern is most powerful in polyglot estates where the per-language SDK overhead is significant, in scenarios where the broker or state store may need to change without an application redeploy, and where Dapr Workflow durability semantics replace standing up a dedicated orchestrator.

How does Container Apps integrate with Microsoft Entra ID and managed identity?

Production Container Apps authenticate to Azure services through user-assigned managed identity — no client secrets stored anywhere in the application, no service principals managed by hand. The Container App fetches a token from the local IMDS endpoint and presents it to Azure SQL, Cosmos DB, Key Vault, Service Bus, Storage, or any Entra-aware resource. For application-level user authentication, Container Apps has built-in authentication providers (Entra ID, Microsoft Account, Google, Facebook, OpenID Connect) configured as an environment property — no code change required to add authentication to a containerized API. For cross-tenant or cross-cloud federation, Microsoft Entra Workload ID federates the Container App identity to an Entra application, replacing the static-credential anti-pattern. The full Entra ID story lives at /microsoft-entra-id-enterprise-2026.

Is Azure Container Apps HIPAA, FedRAMP, and CMMC compliant?

Azure Container Apps in Azure commercial regions is covered by the Microsoft HIPAA BAA, HITRUST CSF, ISO 27001, SOC 1, SOC 2, SOC 3, FedRAMP Moderate, and PCI DSS attestations as of the 2026 service compliance scope. Container Apps in Azure Government regions adds FedRAMP High and DoD Impact Level 2; check the service-level Trust Center listing for the current GCC High and IL5 scope at the time of design. CMMC 2.0 controls map through Azure Policy initiatives applied at management-group scope. EPC Group ships every regulated Container Apps engagement with a documented control matrix, Defender for Cloud HIPAA control mappings, and Resource Graph evidence queries auditors will accept. The broader Defender posture is detailed at /microsoft-defender-for-cloud-cnapp-enterprise-2026.

What does Container Apps actually cost — and how does it compare with App Service and AKS?

On the Consumption plan, Container Apps bills per-second of active vCPU and per-GiB-second of active memory; a Container App scaled to zero costs nothing for compute. On Dedicated workload profiles, billing shifts to per-node-hour on the underlying VM SKU — comparable to an App Service Plan or AKS node pool of the same shape. The economic comparison: for variable-demand workloads (low-traffic APIs, event-driven workers, background jobs) Consumption typically lands 40% to 70% below an always-on App Service Plan or AKS deployment. For high-utilization steady-state workloads (always-on customer-facing APIs at consistent QPS), Dedicated profiles with reservations are roughly comparable to an equivalent App Service Plan and slightly above an equivalent AKS node pool, but without the AKS operational surface. Secondary costs — Log Analytics ingestion, VNET data path, egress — are similar across the three surfaces and managed through commitment tiers, log sampling, and Front Door caching.

How do multi-revision blue/green and canary deployments work in Container Apps?

Container Apps natively supports multi-revision mode — each deployment creates a new immutable revision, and the Container App routes external traffic across revisions by configurable weighted split. A 95/5 split routes 95% to the stable revision and 5% to a canary; instrument both with Application Insights, validate the canary, and shift to 100/0 — or roll back instantly. Revision-label routing additionally supports header-based and cookie-based routing for shadow tests and dark launches. EPC Group pairs the pattern with deployment safeguards in the CI/CD pipeline (synthetic monitoring, automated rollback on SLO breach) so progressive delivery is traceable and auditor-friendly without standing up Argo Rollouts. The same outcome on AKS requires the Argo Rollouts operator install and a custom controller; Container Apps delivers it as a platform property. Detail on the broader Microsoft delivery model lives at /digital-transformation-microsoft-enterprise-2026.

When does Container Apps Jobs replace AKS CronJobs and Azure Batch?

Container Apps Jobs (GA 2024) handles one-shot and scheduled workloads with three trigger types — manual, schedule (cron), and event (queue or Event Hub depth). For nightly batch processing, scheduled report generation, event-driven file processing, and ad-hoc data backfills that previously ran on a VM or AKS CronJob, Container Apps Jobs removes the cluster operational surface while keeping the cost model elastic — pay per second of execution, scale parallel executions on queue depth, exit when done. The right boundary: stay on Container Apps Jobs for the long tail of background workloads where Kubernetes-specific primitives are not required; reach for Azure Batch when the workload genuinely needs MPI patterns, large-scale HPC scheduling, or low-priority VM allocation Container Apps does not expose. EPC Group standardizes on Container Apps Jobs for the background-workload tier in greenfield estates because the operational surface is minimal and the cost model is per-second. The broader serverless context is at /azure-functions-serverless-enterprise-2026.

Continue exploring the EPC Group enterprise Microsoft library

Container Apps is one compute plane inside a broader Microsoft cloud orchestration story. These hubs and analyses cover adjacent and complementary territory.

Microsoft Cloud Orchestrator

The end-to-end Microsoft cloud orchestration model under which Container Apps sits as the serverless container plane.

Azure consulting services

EPC Group Azure consulting service line — landing zones, migrations, governance, and Container Apps at enterprise scale.

Azure Kubernetes Service (AKS) enterprise guide

When the workload needs Kubernetes-specific primitives — Container Apps and AKS coexist in every enterprise estate.

Azure Functions serverless enterprise guide

When short-lived event handlers replace long-running containers — Functions and Container Apps as complements.

Microsoft Entra ID enterprise guide

Identity foundation behind managed identity, Workload ID federation, and the production authentication model for Container Apps.

Microsoft Defender for Cloud CNAPP

How Defender for Cloud covers Container Apps with posture, vulnerability assessment, and Sentinel runtime alerting.

Digital transformation — Microsoft enterprise 2026

The five-stage EPC Group Lifecycle inside which the Container Apps Accelerator is the serverless container workstream.

Standards alignment library

NIST CSF 2.0, ISO 27001, HIPAA, FedRAMP, FINRA, CMMC, and GxP control mappings for Container Apps and the broader Microsoft platform.

Production Container Apps, designed and operated by senior Microsoft architects

Book a Container Apps briefing with an EPC Group senior architect. Two-hour working session — workload inventory, compute-surface decision, environment topology, accelerator scoping. Zero obligation, board-ready output.

Book the briefing 888-381-9725

AI assistant — not human