Cannot delete VNet because of orphaned serviceAssociationLink 'legionservicelink'

Question

Cannot delete VNet because of orphaned serviceAssociationLink 'legionservicelink'

Brian Denicola 20 Microsoft Employee

Unable to delete virtual network 'my-network' (resource group core_rg). Deletion fails because subnet 'agents' contains a lingering serviceAssociationLink 'legionservicelink' with property allowDelete: false. The service that created the link (Microsoft Foundry) was deleted and purged, but the serviceAssociationLink remains and blocks subnet/VNet deletion. Attempts to remove the link via Azure CLI/PowerShell (updating subnet to clear serviceAssociationLinks) have failed. Request Microsoft support assistance to remove the orphaned service association link so the subnet and VNet can be delete.

Tried all suggestions via Copilot already... such as: az network vnet subnet update \

 --resource-group core_rg \

 --vnet-name  my-network \

 --name agents \

 --remove serviceEndpoints

Please don't ask for me to try again. I am only creating this here because the internal support plan will not allow opening SevB/C tickets any longer.

Vallepu Venkateswarlu 8,430 Reputation points Microsoft External Staff Moderator

2026-04-23T19:05:24.39+00:00

Hi Brian Denicola,

Welcome to Microsoft Q&A Platform.

We are actively investigating the case and will reach out to you on Microsoft Teams to continue with further troubleshooting.
Brian Denicola 20 Reputation points Microsoft Employee

2026-04-24T13:14:15.16+00:00

➜ ~ az rest --method POST --uri "/subscriptions/sub_id/providers/Microsoft.Web/locations/eastus2/purgeUnusedVirtualNetworkIntegration?api-version=2024-04-01" --body "{'subnetResourceId': '/subscriptions/sub_id/resourceGroups/cub-34185-core_rg/providers/Microsoft.Network/virtualNetworks/cub-34185-network/subnets/agents'}"

{

"message": "Purged unused virtual network integration.",

"swiftVirtualNetwork": null

}

➜ ~ az network vnet subnet show --name agents --resource-group cub-34185-core_rg --vnet-name cub-34185-network --query "serviceAssociationLinks" [ { "allowDelete": false, "etag": "W/"cf9cdec8-c414-425e-8365-0d4e5e5d2818"", "id": "/subscriptions/sub_id/resourceGroups/cub-34185-core_rg/providers/Microsoft.Network/virtualNetworks/cub-34185-network/subnets/agents/serviceAssociationLinks/legionservicelink", "link": "/subscriptions/sub_id/resourcegroups/cub-34185-core_rg/virtualnetworks/cub-34185-network/subnets/agents", "linkedResourceType": "Microsoft.App/environments", "locations": [], "name": "legionservicelink", "provisioningState": "Succeeded", "resourceGroup": "cub-34185-core_rg", "type": "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks" } ]

➜ ~ az network vnet subnet delete --name agents --resource-group cub-34185-core_rg --vnet-name cub-34185-network

(InUseSubnetCannotBeDeleted) Subnet agents is in use by /subscriptions/sub/resourceGroups/cub-34185-core_rg/providers/Microsoft.Network/virtualNetworks/cub-34185-network/subnets/agents/serviceAssociationLinks/legionservicelink and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet. See aka.ms/deletesubnet.

Code: InUseSubnetCannotBeDeleted

Message: Subnet agents is in use by /subscriptions/sub/resourceGroups/cub-34185-core_rg/providers/Microsoft.Network/virtualNetworks/cub-34185-network/subnets/agents/serviceAssociationLinks/legionservicelink and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet. See aka.ms/deletesubnet.
Brian Denicola 20 Reputation points Microsoft Employee

2026-04-24T13:14:28.6466667+00:00

Still not able to delete.
Rakesh Mishra 8,420 Reputation points Microsoft External Staff Moderator

2026-04-24T13:40:08.6+00:00

Hi Brian, please check Private message or Teams chat and share the requested information to assist you further on this.
Jaseetha satkurunathan 0 Reputation points

2026-04-24T15:46:32.1+00:00

Since you deleted the Foundry service, the subnet link is now locked with allowDelete:false, so we cannot remove it from our side. I have faced a similar issue before, and Microsoft Support/Application Team had to remove the orphaned association from the backend.

Answer accepted by question author

0 additional answers

Your answer

Vallepu Venkateswarlu 8,430 Reputation points Microsoft External Staff Moderator

2026-04-23T19:05:24.39+00:00

Hi Brian Denicola,

Welcome to Microsoft Q&A Platform.

We are actively investigating the case and will reach out to you on Microsoft Teams to continue with further troubleshooting.
Brian Denicola 20 Reputation points Microsoft Employee

2026-04-24T13:14:28.6466667+00:00

Still not able to delete.
Rakesh Mishra 8,420 Reputation points Microsoft External Staff Moderator

2026-04-24T13:40:08.6+00:00

Hi Brian, please check Private message or Teams chat and share the requested information to assist you further on this.
Jaseetha satkurunathan 0 Reputation points

2026-04-24T15:46:32.1+00:00

Since you deleted the Foundry service, the subnet link is now locked with allowDelete:false, so we cannot remove it from our side. I have faced a similar issue before, and Microsoft Support/Application Team had to remove the orphaned association from the backend.

Answer 1

Hi Brian, please find the summary of our discussion and resolution over Teams.

Issue: The underlying container app and foundry tool was deleted but the subnets became orphaned. And subneta were not even when we tried below commands as well.

Try to force backend purge using the Azure REST API for orphaned legionservicelink associations. You can trigger this from the Azure Cloud Shell:

   az rest --method POST \
     --uri "/subscriptions/<SUBSCRIPTION-ID>/providers/Microsoft.Web/locations/<LOCATION>/purgeUnusedVirtualNetworkIntegration?api-version=2024-04-01" \
     --body "{'subnetResourceId': '/subscriptions/<SUBSCRIPTION-ID>/resourceGroups/core_rg/providers/Microsoft.Network/virtualNetworks/my-network/subnets/agents'}"

After running the above command, run the command below to delete the subnet:

   az network vnet subnet delete --resource-group xxx-rg --vnet-name xxxVnet --name xxxSubnet

Cause: There were serviceAssociationLinks which were lingering in backend which were blocking the subnet deletion.

Resolution: With the help of backend team, we purged the serviceAssociationLinks and you were able to delete the subnets after that.

Share via

Cannot delete VNet because of orphaned serviceAssociationLink 'legionservicelink'

0 additional answers

Your answer