Azure Load Balancer
An Azure service that delivers high availability and network performance to applications.
Cannot delete PublicIP because it is associated to vpngwLoadBalancer managed by Azure
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 46%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Justin
0
Reputation points
When deleting my resource group through the portal, the PublicIP was the only resource remaining.
When trying to delete the resource, it prompts me to first disassociate it from the LoadBalancer resource. But as the LoadBalancer was automatically created by azure, there are no permissions for my tenant to access it.
Azure Load Balancer
-
Justin 0 Reputation points
2026-02-23T09:30:51.2+00:00 When trying to access the appgwLoadBalancer
{"sessionId":"<session-id>","subscriptionId":"<subscription-id-2>","resourceGroup":"armrg-<rg-guid>","errorCode":"401","resourceId":"/subscriptions/<subscription-id-2>/resourceGroups/armrg-<rg-guid>/providers/Microsoft.Network/loadBalancers/vpngwLoadBalancer","resourceName":"vpngwLoadBalancer","details":"The access token is from the wrong issuer 'https://sts.windows.net/<tenant-id-1>/'. It must match the tenant 'https://sts.windows.net/<tenant-id-2>/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/<tenant-id-2>' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later."}
The subscription/tenant is not owned by me.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 83%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERV%3C/text%3E%3C/svg%3E)
Ravi Varma Mudduluru 12,625 Reputation points Microsoft External Staff Moderator2026-02-23T10:13:01.0433333+00:00 Hello @Justin,
Thanks for reaching out to Microsoft Q&A.
Could you please check the private message and share us the requested details there
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 71%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGP%3C/text%3E%3C/svg%3E)
Ganesh Patapati 12,170 Reputation points Microsoft External Staff Moderator2026-03-04T10:41:11.3033333+00:00 Hello @ Justin,
Thanks for the reply!
Could you share your email ID through a private message so we can connect on Teams to continue troubleshooting? -
Ganesh Patapati 12,170 Reputation points Microsoft External Staff Moderator
2026-03-09T05:45:20.85+00:00 Hello @ Justin,
Thanks for the reply! Could you share your email ID through a private message so we can connect on Teams to continue troubleshooting?
-
Ganesh Patapati 12,170 Reputation points Microsoft External Staff Moderator
2026-03-09T19:18:05.18+00:00 Hello Justin
The error message suggests that the access token is from the wrong issuer, and it must match one of the tenants associated with this subscription.
Azure always validates that the token issuer (tenant) matches the tenant that owns the subscription.
Right now:
- You authenticated against Tenant‑1 but the subscription belongs to Tenant‑2 which is why Azure rejects the request with 401.
To resolve this issue, you can try the following steps:
Ask the subscription owner (Tenant‑2 admin) to:
- Invite you as a guest user to Tenant‑2 (Azure Entra ID → Users → Invite)
- Assign you a role on the subscription or RG:
- Reader / Contributor / Network Contributor (as required).
Then you must explicitly switch tenant when logging in:
az login --tenant <tenant-id-2> az account set --subscription <subscription-id-2>This forces Azure to issue a token from the correct issuer.
also, try using a different authority (URL) to get the token. You can use the following command to set the authority:
az cloud set --name AzureCloudThis will set the authority to 'https://login.microsoftonline.com/'.
The other reason could be as mentioned in the error "if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message,
please try back later". In case if you have transferred the subscription to different tenant then please wait for some hours and retry the operation again.
And finally,
Remove all public IP addresses that are associated with Azure vpngw Load Balancer and the resource that's used by the subnet. For more information, see View, modify settings for, or delete a public IP address.
In the load balancer, remove the rules for Load Balance rules, Health probes, and Backend pools.
I hope this has been helpful!
If the above is unclear or you are unsure about something, please add a comment below.
Sign in to comment
Sign in to answer