How can I update image or do other maintanance in customer tenant's deployed from Marketplace?

Hello Sebastian !

Thank you for posting on Microsoft Learn.

When you're publishing via Azure Marketplace using a Managed Application, and it's deployed to a customer’s subscription, you do not get default access to the customer's resources unless you specifically configure it that way during offer setup and ARM template deployment.

When creating your offer, make sure:

• The application is set up as a Managed Application (not just a normal ARM template offer).
• It deploys into a Managed Resource Group that you (the publisher) have access to, and the customer does not.

When you publish the application:

• Assign a UAMI or Service Principal to have contributor (or more limited) rights in the Managed Resource Group.

In your C# backend or automation, authenticate using this identity.

If your C# application running outside can authenticate with Azure and access the Managed Resource Group using an identity with RBAC permissions.

var credential = new DefaultAzureCredential(); 
var armClient = new ArmClient(credential);
var subscription = armClient.GetSubscriptionResource(new ResourceIdentifier($"/subscriptions/{subscriptionId}"));
var managedResourceGroup = subscription.GetResourceGroup(managedResourceGroupName);

var containerApps = managedResourceGroup.GetContainerApps();
await foreach (var app in containerApps)
{
    Console.WriteLine($"Found container app: {app.Data.Name}");

    app.Data.Template.Containers[0].Image = "your-new-image:tag";
    await app.UpdateAsync(app.Data);
}