Unable to delete VNet due to orphaned Service Association Link (legionservicelink) after Microsoft.App environment deletion

Architecting Cloud 0 Reputation points
2026-07-29T10:32:46.29+00:00

I'm unable to delete a Virtual Network because Azure reports that the subnet is still in use by a Service Association Link, but all Microsoft.App resources have already been deleted.

Subscription:

Pay-As-You-Go (Basic Support)

Resource Group:

rg-basic-foundry-chat-v2-dev

Virtual Network:

vnet-basic-foundry-chat-v2-dev

Subnet:

snet-agent

What I've verified:

• The resource group now contains only the Virtual Network.

az resource list --resource-group rg-basic-foundry-chat-v2-dev -o table

Output:

vnet-basic-foundry-chat-v2-dev Microsoft.Network/virtualNetworks

• No Microsoft.App managed environments exist.

az resource list --resource-group rg-basic-foundry-chat-v2-dev --resource-type Microsoft.App/managedEnvironments

No results.

• No Container Apps exist.

az containerapp env list --resource-group rg-basic-foundry-chat-v2-dev

No results.

az containerapp list --resource-group rg-basic-foundry-chat-v2-dev

No results.

• No Network Interfaces exist.

az network nic list --resource-group rg-basic-foundry-chat-v2-dev

No results.

The subnet still contains:

  • Delegation: Microsoft.App/environments
  • Service Association Link: legionservicelink
  • linkedResourceType = Microsoft.App/environments
  • allowDelete = false

Resource Graph also shows:

subnetId = 00000000-0000-0000-0000-000000000000

When I try to delete the VNet I receive:

InUseSubnetCannotBeDeleted

Subnet snet-agent is in use by serviceAssociationLinks/legionservicelink.

When I try to remove the subnet delegation I receive:

SubnetMissingRequiredDelegation

The subnet requires delegation Microsoft.App/environments to reference serviceAssociationLinks/legionservicelink.

This creates a circular dependency:

• The subnet cannot be deleted because the Service Association Link exists.

• The delegation cannot be removed because the Service Association Link requires it.

• The Service Association Link cannot be deleted because allowDelete=false.

• There are no remaining Microsoft.App resources that I can delete.

Has anyone encountered this before?

Is there any customer-side method to remove this Service Association Link, or does this require backend cleanup by Microsoft?

Thank you.

Azure Virtual Network
Azure Virtual Network

An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jose Benjamin Solis Nolasco 12,026 Reputation points Volunteer Moderator
    2026-07-29T11:56:21.99+00:00

    Welcome to Microsoft Q&A

    Hello @Architecting Cloud , I hope you are doing well.

    Thank you for providing the detailed troubleshooting steps. Based on your description, you've already verified that:

    • The resource group contains only the Virtual Network.
    • All Microsoft.App managed environments and Container Apps have been deleted.
    • There are no remaining NICs or other dependent resources.
    • The subnet still contains the legionservicelink Service Association Link with allowDelete=false.
    • The subnet delegation cannot be removed because the Service Association Link still exists.

    Given these findings, this does not appear to be a customer configuration issue. Instead, it points to an orphaned Service Association Link (SAL) that was not cleaned up when the Microsoft.App managed environment was deleted.

    The circular dependency you described in this scenario:

    • The subnet cannot be deleted because the SAL exists.
    • The delegation cannot be removed because the SAL references it.
    • The SAL cannot be deleted because it is a managed resource (allowDelete=false).

    As a final validation, you can confirm there are no remaining delegated resources by checking:

    User's image

    If the output still shows the legionservicelink and no corresponding Microsoft.App/environments resource exists, that further indicates the Service Association Link has become orphaned.

    References:

    If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.