AFD origin sharedPrivateLinkResource stuck at deploymentStatus=NotStarted ; status=null despite target-side Private Endpoint connection being Approved (target = ACA managed environment)

Summary

An Azure Front Door Premium origin configured with a sharedPrivateLinkResource targeting an Azure Container Apps managed environment (groupId managedEnvironments) never propagates the private link to the AFD edge. The origin remains at deploymentStatus="NotStarted" and sharedPrivateLinkResource.status=null even though the corresponding Private Endpoint connection on the target managed environment is already Approved / provisioningState=Succeeded. As a result, all requests through the AFD endpoint time out with HTTP 504 (no working origin from the edge's perspective).

The AFD profile SKU is Premium_AzureFrontDoor, so Private Link origin support is available. The private-link resource ID, groupId (managedEnvironments), region (eastus2), and request message all match between the AFD origin and the approved PE connection — i.e., this is the correct, matching connection, not a stale/orphaned one.

Current observed state

AFD origin backend-eus2 (api-version 2024-09-01):

{
  "deploymentStatus": "NotStarted",
  "provisioningState": "Succeeded",
  "enabledState": "Enabled",
  "sharedPrivateLinkResource": {
    "groupId": "managedEnvironments",
    "privateLink": { "id": ".../managedEnvironments/xxxxxxxxx" },
    "privateLinkLocation": "eastus2",
    "requestMessage": "PrivateLinkMessage",
    "status": null
  }
}

ACA managed environment PE connection (api-version 2024-10-02-preview):

{
  "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "properties": {
    "privateLinkServiceConnectionState": { "status": "Approved", "description": "PrivateLinkMessage" },
    "provisioningState": "Succeeded",
    "privateEndpoint": { "id": ".../eafd-Prod-eastus2/providers/Microsoft.Network/privateEndpoints/xxxx-..." }
  }
}

Behavior: GET https://afdendpoint.azurefd.net/health → 504 Gateway Timeout (consistent across many attempts, all paths /*).

Expected behavior

After the target-side PE connection is Approved, the AFD origin should transition deploymentStatus NotStarted → InProgress → Succeeded and sharedPrivateLinkResource.status null → Approved, and the edge should route traffic to the origin over the private link (HTTP 200 from /health).

Steps taken (none unstick it)

1. Confirmed AFD origin sharedPrivateLinkResource correctly references the ACA managed environment (groupId managedEnvironments, region eastus2).
   1. Confirmed the PE connection on the ACA environment is Approved / Succeeded, and matches (same request message, AFD managed subscription c1bc5dd7-…).
   2. Re-wrote the origin via enabledState toggle (Enabled→Disabled→Enabled). deploymentStatus remained NotStarted.
   3. Waited ~16 hours for asynchronous edge propagation. No change — still NotStarted / status=null.
   4. AFD endpoint continued to return 504 for all paths throughout.

Questions for support

1. Why does the AFD origin deploymentStatus stay NotStarted and sharedPrivateLinkResource.status stay null after the target PE connection is Approved? What server-side condition advances these fields?
   1. Is there a known issue with AFD Premium sharedPrivateLinkResource targeting Microsoft.App/managedEnvironments (groupId managedEnvironments) specifically?
   2. What is the supported way to force AFD to (re)start the origin's private-link deployment when it is wedged at NotStarted without dropping/recreating the origin?
   3. Is there an edge-side telemetry/health signal your team can inspect for this origin + FrontDoorId to see why propagation never started?