Unable to delete the azure resource virtualNetworks/test-dspm-connectivi

Question

Unable to delete the azure resource virtualNetworks/test-dspm-connectivi

Ravi Kumar, Rayani V 0

I have attempted to delete the subnet thorugh CLI & from Portal, but the deletion failed with the following error :

-------- Failed to save subnet 'subnet-bastion'.
Error: 'Subnet /subscriptions/6e9bd615-be90-4590-8bce-a2fa1813e82f/resourceGroups/PublicCloudManaged-ComputeScan-Dev/providers/Microsoft.Network/virtualNetworks/test-dspm-connectivity/subnets/subnet-bastion requires any of the following delegation(s) [Microsoft.Web/serverFarms] to reference service association link /subscriptions/6e9bd615-be90-4590-8bce-a2fa1813e82f/resourceGroups/PublicCloudManaged-ComputeScan-Dev/providers/Microsoft.Network/virtualNetworks/test-dspm-connectivity/subnets/subnet-bastion/serviceAssociationLinks/AppServiceLink. Those delegations are either missing or getting deleted from subnet.'

Observation : Checked and confirmed that there is no VNet integration or delegation configured on the subnet. Also tried below approach, but no luck
User's image

Next Action : Since the Service Association Link (SAL) is an internal Azure object that tracks the connection between an Azure service and a subnet, our internal operation team recommended/asked to create a ticket with Microsoft to have the SAL removed.

Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-03-31T12:16:01.3833333+00:00
Hello @Ravi Kumar, Rayani V

Thank you for reaching out regarding this issue.

Since the subnet is blocked by an orphaned App Service VNet Integration Service Association Link, you can first try purging unused VNet integrations using the following command:

az rest --method POST \ --uri "/subscriptions/<SUBSCRIPTION-ID>/providers/Microsoft.Web/locations/<LOCATION>/purgeUnusedVirtualNetworkIntegration?api-version=2024-04-01" \ --body "{'subnetResourceId': '<SUBNET-RESOURCE-ID>'}"

After running the above command, please retry deleting the subnet:

az network vnet subnet delete --resource-group

Please note that this purge operation applies only to unused or orphaned App Service VNet integrations.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "accept" if the information helped you. This will help us and others in the community as well.
Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-04-01T10:13:27.14+00:00

Hi @Ravi Kumar, Rayani V

I'm just reaching out to see if your issue has been resolved or if you've had a chance to review my previous comment?

1 answer

Your answer

Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-03-31T12:16:01.3833333+00:00

Hello @Ravi Kumar, Rayani V

Thank you for reaching out regarding this issue.

Since the subnet is blocked by an orphaned App Service VNet Integration Service Association Link, you can first try purging unused VNet integrations using the following command:

az rest --method POST \ --uri "/subscriptions/<SUBSCRIPTION-ID>/providers/Microsoft.Web/locations/<LOCATION>/purgeUnusedVirtualNetworkIntegration?api-version=2024-04-01" \ --body "{'subnetResourceId': '<SUBNET-RESOURCE-ID>'}"

After running the above command, please retry deleting the subnet:

az network vnet subnet delete --resource-group

Please note that this purge operation applies only to unused or orphaned App Service VNet integrations.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "accept" if the information helped you. This will help us and others in the community as well.
Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-04-01T10:13:27.14+00:00

Hi @Ravi Kumar, Rayani V

I'm just reaching out to see if your issue has been resolved or if you've had a chance to review my previous comment?

Answer 1

The subnet is blocked by an orphaned App Service serviceAssociationLink (AppServiceLink). Because the linked App Service plan no longer exists, the SAL can’t be cleaned up automatically and prevents subnet deletion.

Use one of the following approaches.

Purge the orphaned Service Association Link (preferred)

Run the Azure CLI purge command for unused App Service VNet integration (from Cloud Shell or local CLI) targeting the affected subnet and virtual network.
The purge operation removes the unused virtual network integration and its SAL from the subnet.
After the purge completes successfully, retry deleting or modifying the subnet.

Re-create and cleanly disconnect the App Service integration (workaround) If the purge command doesn’t work or isn’t available in the environment:
Re-create an App Service plan and App Service using the same web app name that originally had VNet integration (if known).
In the Azure portal, open the App Service → Networking → configure VNet integration to the problematic subnet (subnet-bastion).
After integration is established, go back to VNet integration and select Disconnect to remove the integration cleanly.
Delete the App Service and App Service plan if they are no longer needed.
Delete or modify the subnet again; the SAL should now be removed.
Contact Microsoft Support If both approaches fail or the purge API isn’t accessible, open a support request with Microsoft and reference that the subnet is blocked by an orphaned App Service serviceAssociationLink (AppServiceLink) with allowDelete=false. Support can remove the SAL on the backend.

After the SAL is removed, the subnet should delete normally, following the usual order (VM NICs, private endpoints, service deployments, service association links, service endpoints, delegations, then subnet).

References: