Share via

Cannot delete RG rXXXXXXyXXX (sub xxxxxxxx, uksouth) due to orphaned serviceAssociationLink/AppServiceLink on subnet 'web' of XXXXXXX

MD Rafi (Persistent) 40 Reputation points
2026-05-04T15:53:55.1333333+00:00

Summary

Resource group XXXXXXXXX cannot be deleted because subnet web on vXXXXXX has an orphaned serviceAssociationLink/AppServiceLink that references a long-deleted App Service Plan (XXXX-cwydbe6ld). The vnet/subnet cannot be deleted while the SAL exists, and the SAL has allowDelete: false and no live owning resource to clean it up.

Environment

FieldValueSubscription IDXXXXXXXXXXXXXXXXXXXXXXXXSubscription nameCSA-CTO-Engineering-MaintenanceResource groupXXXXXXXXXXRegionXXXXXXXXVNetXXXXXXXXAffected subnetXXXXXXwebOrphaned SALAppServiceLink → Microsoft.Web/serverfarms (ASP no longer exists)Original delete tracking IDXXXXXXXXX ## Original error (from az group delete)

Subnet web is in use by /subscriptions/.../virtualNetworks/vnet-cwydbe6ld/subnets/web/serviceAssociationLinks/AppServiceLink and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet. (Code: InUseSubnetCannotBeDeleted)

Current SAL state

 {
   "name": "AppServiceLink",
   "properties": {
     "linkedResourceType": "Microsoft.Web/serverfarms",
     "allowDelete": false,
     "provisioningState": "Succeeded"
   }
 }

Workarounds already attempted (all failed)

┌───┬──────────────────────────────────────────────────────────────────────┬────────────────────────────────────────────────────┐
│ # │ Workaround                                                           │ Result                                             │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 1 │ Detached and deleted the 3 blocking NSGs                             │ ✅ Succeeded — NSGs gone, SAL still blocks vnet    │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 2 │ Recreated ASP asp-cwydbe6ld with same name + integrated +            │ ❌ New SAL created instead of adopting the orphan  │
│   │ disconnected                                                         │                                                    │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 3 │ POST .../deleteVirtualNetworkOrSubnets on recreated ASP              │ ❌ Only cleans SALs of currently-tracked ASPs      │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 4 │ Direct DELETE on SAL via ARM REST                                    │ ❌ UnauthorizedClientApplication                   │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 5 │ Subnet PATCH removing the SAL property                               │ ❌ SALs are read-only via PATCH                    │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 6 │ Remove subnet delegation Microsoft.Web/serverFarms                   │ ❌ SubnetMissingRequiredDelegation                 │
│   │                                                                      │ (chicken-and-egg)                                  │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 7 │ Check/clear network profiles                                         │ ❌ No network profiles exist                       │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 8 │ az resource delete with API 2022-05-01 on the SAL                    │ ❌ Failed silently, SAL still present              │
├───┼──────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────────┤
│ 9 │ Wait + retry az group delete                                         │ ❌ Goes to Deleting ~5 min, then rolls back        │
└───┴──────────────────────────────────────────────────────────────────────┴────────────────────────────────────────────────────┘

Followed guidance from this Q&A thread and this one — neither resolved it.

Why a support ticket wasn't filed

The subscription's support plan is Internal, which rejects technical tickets at Severity B/C with InvalidSupportPlan. The Azure
Portal "New Support Request" flow redirects here (Microsoft Q&A — Priority Community Support).

Ask

Need backend assistance to force-remove the orphaned AppServiceLink SAL on subnet web so the vnet and resource group can be
deleted. Happy to provide any additional logs / correlation IDs.

Contact

 - Name: Rafi MD
 - Email: XXXXXXXXXXXXX
 - Phone: XXXXXXXXXXXX
 - Country: XXXXXXXXX
 - Timezone: India Standard Time
 - Preferred language: English
edited pii
Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

Answer accepted by question author

  1. Praneeth Maddali 8,775 Reputation points Microsoft External Staff Moderator
    2026-05-04T18:23:17.8733333+00:00

    Hi @MD Rafi (Persistent)

    Thank you for sharing the requested details via the Teams message. This required intervention from the development team, following which the orphaned Service Area Link (SAL) was removed from the system. As discussed offline and confirmed, the issue has been successfully resolved by removing the SAL link and deleting the three resource groups, which was validated by the customer.

    If the answer is helpful,  Please do click "Accept the answer” and Yes, this can be beneficial to other community members.

    If you have any other questions, let me know in the "comments" and I would be happy to help you

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. TP 155.8K Reputation points Volunteer Moderator
    2026-05-04T16:02:05.08+00:00

    Hi,

    Please run command similar to below in Azure Cloud Shell (Bash mode) to purge unused Service Association Link (SAL). Substitute SubscriptionId, Location, SubnetId. Subnet Id can be found by navigating to your subnet in portal and clicking the Copy icon next to Subnet ID

    az rest --method POST \
     --uri "/subscriptions/<SubscriptionId>/providers/Microsoft.Web/locations/<Location>/purgeUnusedVirtualNetworkIntegration?api-version=2024-04-01" \
     --body "{'subnetResourceId': '<SubnetId>'}"

    You should see output similar to below:

    User's image

    Once you have completed the above, try the delete again.

    Please click Accept Answer and upvote if the above was helpful.

    Thanks.

    -TP

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.