Cannot delete Azure Virtual Network (VNet), support keeps telling me to remove a resource outside of my subscription

The subnet and VNet can't be deleted because of a blocking service association link (SAL) of type Microsoft.App/environments with allowDelete = false. This is exactly the kind of cross-service dependency described for subnet deletion failures.

From the tenant side, the only supported actions are:

1. Diagnose the blocking resource on the subnet Use the diagnostic Azure CLI command to list service association links on the subnet and confirm the linkedResourceType:

      az network vnet subnet show \
          --resource-group <resource-group> \
          --vnet-name <vnet-name> \
          --name <subnet-name> \
          --query "serviceAssociationLinks[].{link:link, linkedResourceType:linkedResourceType}" \
          --output table
   

   This will show the serviceAssociationLinks and the linkedResourceType (in this case Microsoft.App/environments).
2. Verify no resources from that linked service remain in the subnet The documented guidance for subnet deletion when service association links exist is:
   • Verify that no resources from the linked service are still deployed in the subnet.
   • Wait 10–15 minutes for the platform to clean up the links.
   • Retry the subnet deletion.
   Since the blocking Microsoft.App/managedEnvironments resource is in another subscription that can't be accessed, this step can't be completed from the current subscription.
3. Escalate via Azure Support with the linkedResourceType and SAL details When service association links persist and can't be cleared by deleting the owning resources, the documented next step is to open an Azure support request and reference the specific linkedResourceType:
   • Open an Azure support request for the affected subscription.
   • Include:
     • The full subnet resource ID.
     • The serviceAssociationLink name (for example, legionservicelink).
     • The linkedResourceType (Microsoft.App/environments).
     • The blocking resource ID that is in the other subscription.
   • Explicitly request backend cleanup of the orphaned service association link or detachment of the Microsoft.App managed environment from the subnet.
   The platform-side cleanup of an orphaned SAL with allowDelete = false is not something that can be performed from the tenant; it must be handled by Azure engineering via the support channel.
4. Retry subnet and VNet deletion after backend cleanup After support confirms that the SAL has been removed or the dependency cleared, retry:
   • Subnet deletion.
   • Then VNet deletion (following the recommended deletion order if other resources exist).

If other blocking resources are present (NICs, private endpoints, delegations, Bastion/Firewall, etc.), they must also be removed as described in the subnet/VNet deletion guidance before the VNet can be deleted.

References:

• Troubleshoot subnet deletion and modification failures in Azure Virtual Network
• Troubleshoot failure to delete or modify a virtual network or subnet in Azure
• Subnet deletion blocked by orphaned App Service serviceAssociationLink - Microsoft Q&A