API Management Service: Unable to update due to service outage — Troubleshooting VNet injection failures

Question

API Management Service: Unable to update due to service outage — Troubleshooting VNet injection failures

maxk-6580 5

Problem description

I am experiencing issues updating my Azure API Management (APIM) service, specifically with Virtual Network (VNet) injection. The update fails during the process, returning an error indicating that the service cannot be updated with VNet injection at this time. I need assistance understanding the cause and how to resolve this issue.

Environment

Azure API Management Service in Canada East region, on the Premium tier, deployed in multiple regions including Italy North and Canada East.

What I've already tried

I completed a network comparison between a successful deployment (bhm07) and the failed one (bhm08-bhm10). I verified that the network configurations, including DNS and routing, are identical across the subnets. I also retried the update sequentially for bhm08-query, reproducing the failure, and preserved the failed state for further analysis.

Current status

I am seeking guidance on diagnosing the root cause of the update failure, specifically related to outbound connectivity or network configuration issues, and instructions on how to proceed to resolve the VNet injection problem.

Max Kryatov 0 Microsoft Employee

Actual error response:

[ERROR] bhm08: [apim-query-mh-bhm08-prd-itn] Async poll failed: 400 {

"error": {

"code": "UpdateApiServiceFailed",

"subCode": null,

"message": "Unable to Update API service with vnet injection at this time. Please make sure the all the requirements are met as specified in the doc https://aka.ms/apimvnet. Otherwise, please open a support case for your API management service using the Azure portal.Please provide correlationId dbc637fe-0e95-4fb1-ba96-a628ef76ede9 and TimeStamp 8/22/2026 10:39:00 PM.",

"details": null,

"innerError": null

}

Mohammad Altaf 360 Reputation points Microsoft External Staff Moderator

2026-08-23T00:45:36.56+00:00

Hello @maxk-6580 ,

Thank you for sharing the details and error information.

I am currently reviewing the APIM VNet Injection update failure and analyzing the deployment behavior in detail. I understand that the update operation is failing with the UpdateApiServiceFailed error despite the network configuration being validated against a working deployment.

I am investigating the issue further to determine the root cause and will provide an update as soon as I have more information to share.

Thank you!

3 answers

Your answer

Max Kryatov 0 Reputation points Microsoft Employee

2026-08-22T23:06:40.36+00:00

Actual error response:

[ERROR] bhm08: [apim-query-mh-bhm08-prd-itn] Async poll failed: 400 {

"error": {

"code": "UpdateApiServiceFailed", "subCode": null, "message": "Unable to Update API service with vnet injection at this time. Please make sure the all the requirements are met as specified in the doc https://aka.ms/apimvnet. Otherwise, please open a support case for your API management service using the Azure portal.Please provide correlationId dbc637fe-0e95-4fb1-ba96-a628ef76ede9 and TimeStamp 8/22/2026 10:39:00 PM.", "details": null, "innerError": null

}

}
Mohammad Altaf 360 Reputation points Microsoft External Staff Moderator

2026-08-23T00:45:36.56+00:00

Hello @maxk-6580 ,

Thank you for sharing the details and error information.

I am currently reviewing the APIM VNet Injection update failure and analyzing the deployment behavior in detail. I understand that the update operation is failing with the UpdateApiServiceFailed error despite the network configuration being validated against a working deployment.

I am investigating the issue further to determine the root cause and will provide an update as soon as I have more information to share.

Thank you!

Answer 1

Hi @maxk-6580 @Max Kryatov

The Azure API Management (APIM) VNet Injection update failed due to an Azure Regional Compute Core quota limitation in the Canada East region.

During the update operation, APIM attempted to provision additional compute capacity. The backend investigation identified that the deployment was blocked by a QuotaExceeded validation error because the subscription did not have sufficient regional compute cores available.

Quota Details:

Region: Canada East
Current Regional Core Limit: 100
Current Usage: 96
Additional Cores Required: 8
Minimum Required Quota: 104

Since the total required cores (104) exceeded the approved regional quota (100), the deployment validation failed and surfaced as the UpdateApiServiceFailed error.

Resolution: Increase the Regional Compute Core quota in the Canada East region to at least 104 cores (or higher based on future capacity requirements), or free unused compute resources in the region and then retry the APIM VNet Injection update.

If the assistance was helpful, kindly take a moment to click on Accept Answer and click on Yes. It will be helpful for other community members.

Thank you!

Answer 2

Max Kryatov 0 Microsoft Employee

Thank you, Mohammad! This explains random nature of HTTP 400 however APIM team needs to take further action to increase compute quota. There is no action on customer side.

0 comments

Answer 3

SHOUMIK CHAKRAVARTY 575

Hello @maxk-6580 - Since both details and innerError are null, the error doesn't point to a specific requirement — so the multi-region checks matter more than subnet comparison.

One thing a subnet comparison won't surface is regional service tags. From the VNet configuration reference: "In multi-region deployments, the NSG in each region should allow traffic to the service tags for that region and the primary region."

So Italy North needs Storage.ItalyNorth, Sql.ItalyNorth, and EventHub.ItalyNorth as well as the Canada East equivalents. If those subnets inherited only the primary region's NSG rules, they'd be missing their own regional tags, which matches the failure on …-prd-itn. This point doesn't apply if you're using the global Storage / Sql / EventHub tags, since those already cover all regions.

Scope note: that reference covers the classic tiers. If these are Premium v2 instances, injection requirements are documented separately.

Also worth checking in multi-region Premium: AzureTrafficManager inbound on 443 (required for external VNet mode) and AzureLoadBalancer inbound on 6390 (Developer SKU is exempt; missing it at Premium blocks control-plane and data-plane access).

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

Max Kryatov 0 Reputation points Microsoft Employee

2026-08-23T18:17:35.1633333+00:00

@SHOUMIK CHAKRAVARTY , thank you for quick reply. I verified this across a successful control stamp and all affected stamps. These are classic Premium services in External VNet mode. Their primary-region NSGs use the global Storage , SQL , AzureActiveDirectory , AzureKeyVault , AzureMonitor , and AzureCloud service tags rather than regional variants, so the global rules already cover Italy North and Canada East. There is no custom outbound deny.

The successful bhm07 control has the same NSG configuration as bhm08-bhm10. The Canada East NSGs are also semantically identical across successful and failed APIM roles and include the required load-balancer and HTTPS access. Therefore, missing regional service tags do not correlate with these failures.

=== bhm07 === query sku=Premium vnetType=External primarySubnet=/subscriptions/7e632f86-0e84-4d3f-84cb-dbc47cce21da/resourceGroups/rg-mh-bhm07-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm07-prd-itn/subnets/snet-apim-query NSG=nsg-apim-mh-bhm07-prd-itn customOutbound=7 OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443 OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443 OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443 OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433 OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443 OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886 OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443 IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443 ingestion sku=Premium vnetType=External primarySubnet=/subscriptions/7e632f86-0e84-4d3f-84cb-dbc47cce21da/resourceGroups/rg-mh-bhm07-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm07-prd-itn/subnets/snet-apim-ingestion NSG=nsg-apim-mh-bhm07-prd-itn customOutbound=7 OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443 OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443 OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443 OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433 OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443 OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886 OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443 IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443 management sku=Premium vnetType=External primarySubnet=/subscriptions/7e632f86-0e84-4d3f-84cb-dbc47cce21da/resourceGroups/rg-mh-bhm07-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm07-prd-itn/subnets/snet-apim-management NSG=nsg-apim-mh-bhm07-prd-itn customOutbound=7 OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443 OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443 OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443 OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433 OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443 OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886 OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443 IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

=== bhm08 ===

query sku=Premium vnetType=External primarySubnet=/subscriptions/97d91f75-499b-44fa-90f0-909cd272933e/resourceGroups/rg-mh-bhm08-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm08-prd-itn/subnets/snet-apim-query NSG=nsg-apim-mh-bhm08-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

ingestion sku=Premium vnetType=External primarySubnet=/subscriptions/97d91f75-499b-44fa-90f0-909cd272933e/resourceGroups/rg-mh-bhm08-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm08-prd-itn/subnets/snet-apim-ingestion NSG=nsg-apim-mh-bhm08-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

management sku=Premium vnetType=External primarySubnet=/subscriptions/97d91f75-499b-44fa-90f0-909cd272933e/resourceGroups/rg-mh-bhm08-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm08-prd-itn/subnets/snet-apim-management NSG=nsg-apim-mh-bhm08-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

=== bhm09 ===

query sku=Premium vnetType=External primarySubnet=/subscriptions/9c63c104-effc-4d28-8b12-91e2125da2fd/resourceGroups/rg-mh-bhm09-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm09-prd-itn/subnets/snet-apim-query NSG=nsg-apim-mh-bhm09-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

ingestion sku=Premium vnetType=External primarySubnet=/subscriptions/9c63c104-effc-4d28-8b12-91e2125da2fd/resourceGroups/rg-mh-bhm09-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm09-prd-itn/subnets/snet-apim-ingestion NSG=nsg-apim-mh-bhm09-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

management sku=Premium vnetType=External primarySubnet=/subscriptions/9c63c104-effc-4d28-8b12-91e2125da2fd/resourceGroups/rg-mh-bhm09-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm09-prd-itn/subnets/snet-apim-management NSG=nsg-apim-mh-bhm09-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

=== bhm10 ===

query sku=Premium vnetType=External primarySubnet=/subscriptions/71b904d0-b89b-4b43-ab67-4fce5703d1b8/resourceGroups/rg-mh-bhm10-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm10-prd-itn/subnets/snet-apim-query NSG=nsg-apim-mh-bhm10-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

ingestion sku=Premium vnetType=External primarySubnet=/subscriptions/71b904d0-b89b-4b43-ab67-4fce5703d1b8/resourceGroups/rg-mh-bhm10-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm10-prd-itn/subnets/snet-apim-ingestion NSG=nsg-apim-mh-bhm10-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443

management sku=Premium vnetType=External primarySubnet=/subscriptions/71b904d0-b89b-4b43-ab67-4fce5703d1b8/resourceGroups/rg-mh-bhm10-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm10-prd-itn/subnets/snet-apim-management NSG=nsg-apim-mh-bhm10-prd-itn customOutbound=7

OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443

OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443

OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443

OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433

OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443

OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886

OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443

IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
SHOUMIK CHAKRAVARTY 575 Reputation points

2026-08-23T21:24:46.65+00:00
Thanks for sharing the full logs. That also covers the AzureLoadBalancer 6390 point; the default AllowAzureLoadBalancerInBound rule at priority 65001 already satisfies that requirement.

One thing in your dump is worth pulling on: those are four different subscriptions — 7e632f86, 97d91f75, 9c63c104, 71b904d0. Identical NSGs across them is expected from a shared template, but it also means the NSG layer can't reveal a per-subscription difference.

Security admin rules would. From the NSG overview: "Security admin rules always have a higher priority than network security group rules and thus are evaluated first… 'Deny' security admin rules block the traffic without delivering it to the destination." They come from Azure Virtual Network Manager, scoped separately from the NSG and invisible in an NSG dump. Is AVNM applied consistently across all four subscriptions?

Given NRMS-Rule-101 looks like a governed baseline, it's worth comparing the effective rules directly rather than assuming. This returns them per VNet, so you can run it against each stamp and diff:

az network manager list-effective-security-admin-rule --resource-group rg-mh-bhm07-prd-itn --virtual-network-name vnet-mh-bhm07-prd-itn --subscription <subscription-id>

Then the same for bhm08–bhm10 with their own subscription IDs. If bhm07 returns a different rule set to the others, that's your difference — and it's one an NSG comparison would never have shown.

One thing aside, unrelated to why bhm07 differs: is that inbound list filtered? It shows a single rule, VirtualNetwork on 443, which only duplicates the default. If that's the complete set, ApiManagement → 3443, Internet → 443 and AzureTrafficManager → 443 would all be denied on every stamp including bhm07 — so probably a filtered view, but worth confirming.

Please check once and confirm if this helps here.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Max Kryatov 0 Reputation points Microsoft Employee

2026-08-24T05:36:55.8966667+00:00

Azure Virtual Network Manager security-admin rules

I queried the effective security-admin rules for both the primary Italy North VNet and the Canada East scaffold VNet in each of bhm07 , bhm08 , bhm09 , and bhm10, eight VNets across four subscriptions. Every query returned:

Effective security admin rules: 0

Therefore, AVNM is not applying a hidden Deny , Allow , or AlwaysAllow rule, and there is no per-subscription AVNM difference between the successful control and affected stamps.

Complete inbound NSG rules

You were correct that the earlier output was filtered; it was not the complete inbound list. I subsequently exported all custom and default inbound rules.

The primary NSGs for bhm07–bhm10 all explicitly contain the same required rules:

AzureFrontDoor.Backend -> TCP 443

ApiManagement -> TCP 3443

AzureLoadBalancer -> TCP 6390

AzureTrafficManager -> TCP 443

They also contain the same NRMS baseline and default NSG rules. ARM returns the rules in different array orders, but their names, priorities, access, direction, sources, destinations, protocols, and ports are identical.

We also confirmed the following:

• These are classic Premium services in External VNet mode.

• The primary NSGs use global Storage , SQL , AzureActiveDirectory , AzureKeyVault , AzureMonitor , and AzureCloud outbound service tags.

• There is no custom outbound deny.

• The global tags already cover Italy North and Canada East, so regional variants would be redundant.

• The Canada East scaffold NSGs are semantically identical across successful and failed APIM roles.

• There is no custom DNS, UDR, NAT gateway, firewall/NVA path, subnet lock, or unresolved policy-remediation failure.

• bhm07 succeeded with the same effective network controls.

• bhm08-query has failed repeatedly in sequential retries

At this point, neither ordinary NSG rules nor AVNM security-admin rules explain the selective failures.
Max Kryatov 0 Reputation points Microsoft Employee

2026-08-24T17:24:44.3333333+00:00

@SHOUMIK CHAKRAVARTY , can we get someone from product team to take a look? This issue is completely blocking a high-priority SFI infrastructure update.
SHOUMIK CHAKRAVARTY 575 Reputation points

2026-08-25T02:00:03.29+00:00

Hello @Max Kryatov - I am trying to see if I can get some help here through internal channels.

Hi @Mohammad Altaf - Do you have any further updates here? Flagging that this has since been described as blocking an SFI update.
Max Kryatov 0 Reputation points Microsoft Employee

2026-08-25T04:48:22.94+00:00

Additionally to ITN region, exactly the same issue is observed in SEC region as well:

bhm03 Failed 00:18:42 [apim-query-mh-bhm03-prd-sec] Async poll failed: 400 { "error": { "code": "UpdateApiServiceFailed", "subCode": null, "message": "Unable to Update API service with vnet injection at this time. Please make sure the all the requirements are met as specified in the doc https://aka.ms/apimvnet. Otherwise, please open a support case for your API management service using the Azure portal.Please provide correlationId 4fc8d9a9-4d20-4dee-8e3f-e1d3ff18c1bb and TimeStamp 8/25/2026 4:14:10 AM.", "details": null, "innerError": null } }
Mohammad Altaf 360 Reputation points Microsoft External Staff Moderator

2026-08-25T23:04:26.0866667+00:00

Hi @Max Kryatov @maxk-6580

We have received an update from our engineering team.

The APIM VNet Injection update failure is caused by an Azure Regional Compute Core quota limitation in the Canada East region. The current subscription quota is 100 cores, with 96 cores already in use, while the update requires an additional 8 cores. As a result, the deployment exceeds the approved quota and fails.

To proceed, please increase the Regional Core quota in Canada East to at least 104 cores (or higher) and then retry the APIM update.

Thank you!
SHOUMIK CHAKRAVARTY 575 Reputation points

2026-08-27T00:19:29.19+00:00

Hi @Max Kryatov - If this has helped resolve your issue, please consider accepting the answer. If not, feel free to reply with more details.
Max Kryatov 0 Reputation points Microsoft Employee

2026-08-27T03:45:28.7866667+00:00

Root cause is still not addressed. Partial reply from product team was helpful but incomplete. Pasting extra diagnostics uncovered by SRE agent:

API Management Service: Unable to update due to service outage — Troubleshooting VNet injection failures

Problem description

Environment

What I've already tried

Current status

3 answers

Azure Virtual Network Manager security-admin rules

Complete inbound NSG rules

Your answer