diff --git a/CHANGELOG.md b/CHANGELOG.md
index 47a063de8512..a4d1c295a646 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 ## 2.25.0 (Unreleased)
 
+UPGRADE NOTES:
+
+* `azurerm_container_group` - previously the value of `PRIVATE_EMPTY` field wouldn't be stored into state file when it is set as empty string in tf config, but the behavior has been updated, and now it would be stored. ([#8096](https://github.com/terraform-providers/terraform-provider-azurerm/issues/8096))
+
 IMPROVEMENTS:
 
 * `azurerm_batch_pool` - Remove `network_configuration` from update payload [GH-8189]
diff --git a/azurerm/internal/services/containers/container_group_resource.go b/azurerm/internal/services/containers/container_group_resource.go
index aede6d921fe5..81db3d35ed67 100644
--- a/azurerm/internal/services/containers/container_group_resource.go
+++ b/azurerm/internal/services/containers/container_group_resource.go
@@ -1151,10 +1151,8 @@ func flattenContainerEnvironmentVariables(input *[]containerinstance.Environment
 	if isSecure {
 		for _, envVar := range *input {
 			if envVar.Name != nil && envVar.Value == nil {
-				if v, ok := d.GetOk(fmt.Sprintf("container.%d.secure_environment_variables.%s", oldContainerIndex, *envVar.Name)); ok {
-					log.Printf("[DEBUG] SECURE    : Name: %s - Value: %s", *envVar.Name, v.(string))
-					output[*envVar.Name] = v.(string)
-				}
+				envVarValue := d.Get(fmt.Sprintf("container.%d.secure_environment_variables.%s", oldContainerIndex, *envVar.Name))
+				output[*envVar.Name] = envVarValue
 			}
 		}
 	} else {
diff --git a/azurerm/internal/services/containers/tests/container_group_resource_test.go b/azurerm/internal/services/containers/tests/container_group_resource_test.go
index 34c0a42e5578..9502cf553b5a 100644
--- a/azurerm/internal/services/containers/tests/container_group_resource_test.go
+++ b/azurerm/internal/services/containers/tests/container_group_resource_test.go
@@ -424,6 +424,27 @@ func TestAccAzureRMContainerGroup_windowsComplete(t *testing.T) {
 	})
 }
 
+func TestAccAzureRMContainerGroup_withPrivateEmpty(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_container_group", "test")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acceptance.PreCheck(t) },
+		Providers:    acceptance.SupportedProviders,
+		CheckDestroy: testCheckAzureRMContainerGroupDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAzureRMContainerGroup_withPrivateEmpty(data),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMContainerGroupExists(data.ResourceName),
+				),
+			},
+			data.ImportStep(
+				"container.0.secure_environment_variables.PRIVATE_VALUE",
+			),
+		},
+	})
+}
+
 func testAccAzureRMContainerGroup_SystemAssignedIdentity(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 provider "azurerm" {
@@ -1239,3 +1260,47 @@ func testCheckAzureRMContainerGroupDestroy(s *terraform.State) error {
 
 	return nil
 }
+
+func testAccAzureRMContainerGroup_withPrivateEmpty(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-containergroup-%d"
+  location = "%s"
+}
+
+resource "azurerm_container_group" "test" {
+  name                = "acctestcontainergroup-%d"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+  ip_address_type     = "public"
+  dns_name_label      = "jerome-aci-label"
+  os_type             = "Linux"
+
+  container {
+    name   = "hello-world"
+    image  = "microsoft/aci-helloworld:latest"
+    cpu    = "0.5"
+    memory = "1.5"
+
+    ports {
+      port     = 8000
+      protocol = "TCP"
+    }
+
+    secure_environment_variables = {
+      PRIVATE_EMPTY = ""
+      PRIVATE_VALUE = "test"
+    }
+
+    environment_variables = {
+      PUBLIC_EMPTY = ""
+      PUBLIC_VALUE = "test"
+    }
+  }
+}
+`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
+}