Unable to delete subnet because of orphaned SAL

Question

Unable to delete subnet because of orphaned SAL

Prakhar Parimal 56

I'm trying to delete an azure subnet but getting error "Failed to save subnet 'agent-subnet'. Error: 'Subnet /subscriptions/1551aa63-0970-481e-9119-39af8a03628b/resourceGroups/ZNE-LA-N-01-AI-RSG/providers/Microsoft.Network/virtualNetworks/agent-vnet-test/subnets/agent-subnet requires any of the following delegation(s) [Microsoft.App/environments] to reference service association link /subscriptions/1551aa63-0970-481e-9119-39af8a03628b/resourceGroups/ZNE-LA-N-01-AI-RSG/providers/Microsoft.Network/virtualNetworks/agent-vnet-test/subnets/agent-subnet/serviceAssociationLinks/legionservicelink. Those delegations are either missing or getting deleted from subnet."

since allowDelete: False , I'm unable to delete it because of orphaned Service Association Link. How can I do force cleanup

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello @Prakhar Parimal

The error indicates that the subnet still contains a service-managed Service Association Link (SAL):

serviceAssociationLinks/legionservicelink

linkedResourceType: Microsoft.App/environments

allowDelete: false

This is typically created by an Azure Container Apps/Foundry managed environment. Because allowDelete is false, you shouldn't try to force-delete the SAL or remove the Microsoft.App/environments delegation first.

Start by confirming whether any managed environment still exists:

az containerapp env list -o table

and inspect the subnet:

az network vnet subnet show \
  --resource-group ZNE-LA-N-01-AI-RSG \
  --vnet-name agent-vnet-test \
  --name agent-subnet \
  --query "{delegations:delegations,serviceAssociationLinks:serviceAssociationLinks}"

If no Microsoft.App/environments resource remains but legionservicelink is still present, then this is an orphaned SAL.

There have been multiple recent cases with exactly this Microsoft.App/environments/legionservicelink condition. Unlike the Microsoft.Web App Service SAL, there isn't a documented customer-side purge operation for this particular Microsoft.App SAL; persistent cases have required provider/backend cleanup.

So I would not use the commonly suggested: Microsoft.Web/.../purgeUnusedVirtualNetworkIntegration command here. That's intended for App Service (Microsoft.Web) VNet integration and doesn't match your Microsoft.App/environments SAL.

If the associated environment was only recently deleted, allow some time for asynchronous cleanup and retry. If the SAL persists, this needs Microsoft intervention.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.