MS Discovery workspace failed deploy left orphan legionservicelink SAL on agentSubnet — backend purge needed to unlock VNet/RG delete

The subnet, virtual network, and resource group deletions are blocked because the agentSubnet still has a service association link (SAL) and is treated as in use. This matches the documented behavior for Azure virtual networks and subnets: any remaining delegations, service association links, private endpoints, or IP configurations prevent subnet and VNet deletion.

From the current guidance, this scenario is handled as follows:

1. Confirm what is blocking the subnet Use the diagnostic view on the subnet to verify what is still attached:
   • delegations (for example Microsoft.Web/serverFarms, Microsoft.ContainerService/managedClusters, etc.)
   • serviceAssociationLinks (SALs)
   • ipConfigurations (NICs or other IP configs)
   • privateEndpoints
   • serviceEndpoints
   The documentation states that if any of these fields contain values, those resources must be removed before the subnet can be deleted or modified.
2. Understand the error behavior The errors being seen (InUseSubnetCannotBeDeleted, VNet/RG stuck in Deleting) are consistent with the documented common errors:
   • Subnet <name> is in use and cannot be deleted. / InUseSubnetCannotBeDeleted occur when the subnet still has IP configurations or other resources.
   • SubnetWithExternalResourcesCannotBeUsedByOtherResources and SAL-related issues occur when another Azure service has deployed resources into the subnet and left a SAL.
3. Standard SAL cleanup path for App Service / Web integration For App Service–style integrations, the documented remediation is:
   • First try to purge orphaned SALs using:

          az rest --method POST \
            --uri "/subscriptions/<SUBSCRIPTION-ID>/providers/Microsoft.Web/locations/<LOCATION>/purgeUnusedVirtualNetworkIntegration?api-version=2024-04-01" \
            --body "{'subnetResourceId': '<SUBNET-RESOURCE-ID>'}"
     

   • On success, the response is:

          {
            "message": "Purged unused virtual network integration.",
            "swiftVirtualNetwork": null
          }
     

   • If that does not clear the SAL and the subnet still cannot be updated or deleted, the guidance is to:
     1. Re-create the App Service plan and app with the same web app name.
     2. Reconfigure virtual network integration on the app.
     3. Use Disconnect on the integration.
     4. Delete the App Service plan or app.
     5. Retry the subnet/VNet operations.
   • If issues persist after these steps, the documentation explicitly instructs to contact Microsoft Support for further assistance.
4. When user-side cleanup is exhausted The documentation for virtual network and subnet deletion issues makes clear that:
   • Subnets with delegations or SALs created by platform services (for example App Service, AKS, SQL Managed Instance, etc.) cannot be deleted until those associations are removed.
   • When the owning service resource no longer exists and standard cleanup (including the purge API) does not remove the SAL, further remediation requires platform-side intervention.

Given that:

• The SAL (legionservicelink) remains on agentSubnet with allowDelete: false.
• The owning capability host no longer exists.
• The documented purge method for orphaned App Service SALs has already been attempted and did not remove the SAL.

The remaining action is to open a support case with Microsoft Support and provide:

• The full subnet resource ID.
• The SAL name and linkedResourceType.
• The errors observed when deleting the subnet/VNet/RG.
• The confirmation that the purge API and other documented cleanup steps have been attempted.

The backend networking/App Service teams can then perform the required platform-side purge of the lingering service association link so that the subnet, virtual network, and resource group deletions can complete.

References:

• Troubleshoot failure to delete or modify a virtual network or subnet in Azure
• Integrate your app with an Azure virtual network
• Configure network security for Microsoft Discovery workspaces
• az network vnet subnet delete
• az stack-hci-vm network vnet subnet delete