I can't delete resource group because of lingering capability host

Hello Jay Lee,

Welcome to Microsoft Q&A and Thank you for reaching out.

I understand that the resource group deletion is blocked due to an orphaned capability host environment created by Azure AI Foundry, which provisioned a managed Azure Container Apps** Environment** in a Microsoft-managed subscription. When the Foundry workspace was deleted, the backend cleanup did not fully complete, leaving behind a service association link (legionservicelink) on your subnet with allowDelete:false. Because of this link, Azure prevents deletion of the VNet and therefore the rg-foundry-dev-eastus2 resource group.

Below are steps you can try to identify and remove the lingering resources.

1. Identify the service link

First, confirm that the legionservicelink still exists on the subnet:

az resource show \

This command retrieves details about the service association link that is preventing the subnet from being deleted.

2. Remove the lingering service link

If you have the required permissions to the Microsoft-managed subscription, you can attempt to delete the service link:

az resource delete \

3. Delete the orphaned Container Apps Environment

If the environment still exists, you can try deleting the associated Container Apps Environment:

az containerapp env delete \

Removing this environment should release the subnet association and allow the resource group to be deleted.

In many cases, the managed environment resides in a Microsoft-managed subscription, so customers typically do not have permission to delete these resources. If you encounter an error such as allowDelete:false or insufficient permissions, the cleanup must be performed by Microsoft backend teams.

The resource group cannot be deleted because an orphaned Container Apps Environment created by Azure AI Foundry’s capability host still holds a legionservicelink on your subnet with allowDelete:false. Removing that environment or the associated service link will unblock deletion of the resource group.

I Hope this helps. Do let me know if you have any further queries.

Thank you!

Hi Jay Lee,

Did you get any chance to review the above response. Do let me know if you have any further queries.

Thank you!

It doesn't help. Please connect me to the support engineer

Hi Jay Lee

Thank you in joining in the team's call yesterday.

Observation recorded on call

It seems you had secured the foundry resource with virtual network. We are not able to delete the subnet manually because it is associated with capability host (which was not cleaned during bulk deletion in RG, we normally delete private endpoint then foundry deployments then RG to avoid these issues)

Putting the documentation on deleting capability host while I am doing minimal replication with above setup before escalating to product group for clean-up from backend.

Thank you for staying patient so far.

Hey Jay Lee

I have shared a series of commands to delete the legionservicelinks associated with VNET.

Shall reach engineering team if the shared commands do not help.

Thank you for staying patient.