Unable to delete a subnet due to a delegation issue

Hi t0Sanjay,

Thanks for posting question in Microsoft Q&A.

This issue occurs because the new VNet Integration feature (Regional VNet Integration) adds locks to subnets using a structure called a Service Association Link (SAL). These locks, managed by Azure's internal services like Microsoft.Web, occasionally fail to clean up properly. As a result, the subnet remains locked, preventing deletion or reuse.

Below are the steps to resolve the subnet delegation issue by recreating the correct App Service Plan association:

1. In Azure Cloud Shell, run the following command to check which App Service Plan is linked to the subnet:

      az network vnet subnet list --resource-group Redacted --vnet-name redacted 
   

   Under serviceAssociationLinks/link, note the App Service Plan name (e.g., <App service name>).
2. Create a new Web App using the same Subscription, Resource Group, and region.
3. In the Pricing plan section, select Create new. Use the same App Service Plan name identified earlier (e.g., ASP-xxxxxxx).
4. Go to the Networking tab of the Web App creation wizard.
   • Enable Virtual network integration.
   • Select the VNet: redacted
   • Under Outbound access, select Enable VNet Integration and choose the subnet backend_subnet.
5. Complete the deployment (Review + Create).
6. After deployment completes, open the App Service Plan (e.g., ASP-xxxxx). Navigate to Settings > Networking > VNet Integration and select Click here to manage. The Regional VNet integrations should show 1/2, with the VNet Backends/backend_subnet listed.
7. Open the Web App again → Settings > Networking > Outbound traffic configuration. The integration should already be set to Backends/backend_subnet.
8. Select Backends/backend_subnet and choose Disconnect to remove the unwanted link so the subnet can be deleted.

After completing the steps above, running the following command confirmed that the serviceAssociationLinks entry was successfully removed:

az network vnet subnet list --resource-group redacted --vnet-name redacted

Once the link was no longer present, the subnet delegation could be removed, and the subnet was successfully deleted.

Reference:

• Add or Remove Subnet Delegation in Azure Virtual Network | Microsoft Learn
• Cannot delete a subnet due to AppServicelink and the previous App service plan has been deleted - Microsoft Q&A

Thank you. Followed your instructions but it is not working. Can you schedule a meeting?