This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(118.4, 1%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM6%3C/text%3E%3C/svg%3E)
I am experiencing issues updating my Azure API Management (APIM) service, specifically with Virtual Network (VNet) injection. The update fails during the process, returning an error indicating that the service cannot be updated with VNet injection at this time. I need assistance understanding the cause and how to resolve this issue.
Azure API Management Service in Canada East region, on the Premium tier, deployed in multiple regions including Italy North and Canada East.
I completed a network comparison between a successful deployment (bhm07) and the failed one (bhm08-bhm10). I verified that the network configurations, including DNS and routing, are identical across the subnets. I also retried the update sequentially for bhm08-query, reproducing the failure, and preserved the failed state for further analysis.
I am seeking guidance on diagnosing the root cause of the update failure, specifically related to outbound connectivity or network configuration issues, and instructions on how to proceed to resolve the VNet injection problem.
An Azure service that provides a hybrid, multi-cloud management platform for APIs.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 36%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMK%3C/text%3E%3C/svg%3E)
Actual error response:
[ERROR] bhm08: [apim-query-mh-bhm08-prd-itn] Async poll failed: 400 {
"error": {
"code": "UpdateApiServiceFailed",
"subCode": null,
"message": "Unable to Update API service with vnet injection at this time. Please make sure the all the requirements are met as specified in the doc https://aka.ms/apimvnet. Otherwise, please open a support case for your API management service using the Azure portal.Please provide correlationId dbc637fe-0e95-4fb1-ba96-a628ef76ede9 and TimeStamp 8/22/2026 10:39:00 PM.",
"details": null,
"innerError": null
}
}
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 79%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMA%3C/text%3E%3C/svg%3E)
Hello @maxk-6580 ,
Thank you for sharing the details and error information.
I am currently reviewing the APIM VNet Injection update failure and analyzing the deployment behavior in detail. I understand that the update operation is failing with the UpdateApiServiceFailed error despite the network configuration being validated against a working deployment.
I am investigating the issue further to determine the root cause and will provide an update as soon as I have more information to share.
Thank you!
The Azure API Management (APIM) VNet Injection update failed due to an Azure Regional Compute Core quota limitation in the Canada East region.
During the update operation, APIM attempted to provision additional compute capacity. The backend investigation identified that the deployment was blocked by a QuotaExceeded validation error because the subscription did not have sufficient regional compute cores available.
Quota Details:
Since the total required cores (104) exceeded the approved regional quota (100), the deployment validation failed and surfaced as the UpdateApiServiceFailed error.
Resolution: Increase the Regional Compute Core quota in the Canada East region to at least 104 cores (or higher based on future capacity requirements), or free unused compute resources in the region and then retry the APIM VNet Injection update.
Thank you!
Thank you, Mohammad! This explains random nature of HTTP 400 however APIM team needs to take further action to increase compute quota. There is no action on customer side.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 50%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESC%3C/text%3E%3C/svg%3E)
Hello @maxk-6580 - Since both details and innerError are null, the error doesn't point to a specific requirement — so the multi-region checks matter more than subnet comparison.
One thing a subnet comparison won't surface is regional service tags. From the VNet configuration reference: "In multi-region deployments, the NSG in each region should allow traffic to the service tags for that region and the primary region."
So Italy North needs Storage.ItalyNorth, Sql.ItalyNorth, and EventHub.ItalyNorth as well as the Canada East equivalents. If those subnets inherited only the primary region's NSG rules, they'd be missing their own regional tags, which matches the failure on …-prd-itn. This point doesn't apply if you're using the global Storage / Sql / EventHub tags, since those already cover all regions.
Scope note: that reference covers the classic tiers. If these are Premium v2 instances, injection requirements are documented separately.
Also worth checking in multi-region Premium: AzureTrafficManager inbound on 443 (required for external VNet mode) and AzureLoadBalancer inbound on 6390 (Developer SKU is exempt; missing it at Premium blocks control-plane and data-plane access).
Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.
@SHOUMIK CHAKRAVARTY , thank you for quick reply. I verified this across a successful control stamp and all affected stamps. These are classic Premium services in External VNet mode. Their primary-region NSGs use the global Storage , SQL , AzureActiveDirectory , AzureKeyVault , AzureMonitor , and AzureCloud service tags rather than regional variants, so the global rules already cover Italy North and Canada East. There is no custom outbound deny.
The successful bhm07 control has the same NSG configuration as bhm08-bhm10. The Canada East NSGs are also semantically identical across successful and failed APIM roles and include the required load-balancer and HTTPS access. Therefore, missing regional service tags do not correlate with these failures.
=== bhm07 === query sku=Premium vnetType=External primarySubnet=/subscriptions/7e632f86-0e84-4d3f-84cb-dbc47cce21da/resourceGroups/rg-mh-bhm07-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm07-prd-itn/subnets/snet-apim-query NSG=nsg-apim-mh-bhm07-prd-itn customOutbound=7 OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443 OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443 OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443 OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433 OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443 OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886 OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443 IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443 ingestion sku=Premium vnetType=External primarySubnet=/subscriptions/7e632f86-0e84-4d3f-84cb-dbc47cce21da/resourceGroups/rg-mh-bhm07-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm07-prd-itn/subnets/snet-apim-ingestion NSG=nsg-apim-mh-bhm07-prd-itn customOutbound=7 OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443 OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443 OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443 OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433 OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443 OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886 OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443 IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443 management sku=Premium vnetType=External primarySubnet=/subscriptions/7e632f86-0e84-4d3f-84cb-dbc47cce21da/resourceGroups/rg-mh-bhm07-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm07-prd-itn/subnets/snet-apim-management NSG=nsg-apim-mh-bhm07-prd-itn customOutbound=7 OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443 OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443 OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443 OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433 OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443 OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886 OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443 IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
=== bhm08 ===
query sku=Premium vnetType=External primarySubnet=/subscriptions/97d91f75-499b-44fa-90f0-909cd272933e/resourceGroups/rg-mh-bhm08-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm08-prd-itn/subnets/snet-apim-query NSG=nsg-apim-mh-bhm08-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
ingestion sku=Premium vnetType=External primarySubnet=/subscriptions/97d91f75-499b-44fa-90f0-909cd272933e/resourceGroups/rg-mh-bhm08-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm08-prd-itn/subnets/snet-apim-ingestion NSG=nsg-apim-mh-bhm08-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
management sku=Premium vnetType=External primarySubnet=/subscriptions/97d91f75-499b-44fa-90f0-909cd272933e/resourceGroups/rg-mh-bhm08-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm08-prd-itn/subnets/snet-apim-management NSG=nsg-apim-mh-bhm08-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
=== bhm09 ===
query sku=Premium vnetType=External primarySubnet=/subscriptions/9c63c104-effc-4d28-8b12-91e2125da2fd/resourceGroups/rg-mh-bhm09-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm09-prd-itn/subnets/snet-apim-query NSG=nsg-apim-mh-bhm09-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
ingestion sku=Premium vnetType=External primarySubnet=/subscriptions/9c63c104-effc-4d28-8b12-91e2125da2fd/resourceGroups/rg-mh-bhm09-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm09-prd-itn/subnets/snet-apim-ingestion NSG=nsg-apim-mh-bhm09-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
management sku=Premium vnetType=External primarySubnet=/subscriptions/9c63c104-effc-4d28-8b12-91e2125da2fd/resourceGroups/rg-mh-bhm09-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm09-prd-itn/subnets/snet-apim-management NSG=nsg-apim-mh-bhm09-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
=== bhm10 ===
query sku=Premium vnetType=External primarySubnet=/subscriptions/71b904d0-b89b-4b43-ab67-4fce5703d1b8/resourceGroups/rg-mh-bhm10-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm10-prd-itn/subnets/snet-apim-query NSG=nsg-apim-mh-bhm10-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
ingestion sku=Premium vnetType=External primarySubnet=/subscriptions/71b904d0-b89b-4b43-ab67-4fce5703d1b8/resourceGroups/rg-mh-bhm10-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm10-prd-itn/subnets/snet-apim-ingestion NSG=nsg-apim-mh-bhm10-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
management sku=Premium vnetType=External primarySubnet=/subscriptions/71b904d0-b89b-4b43-ab67-4fce5703d1b8/resourceGroups/rg-mh-bhm10-prd-itn/providers/Microsoft.Network/virtualNetworks/vnet-mh-bhm10-prd-itn/subnets/snet-apim-management NSG=nsg-apim-mh-bhm10-prd-itn customOutbound=7
OUT nsgr-apim-Outbound-114 prio=114 Allow dst=Storage ports=443
OUT nsgr-apim-Outbound-115 prio=115 Allow dst=AzureActiveDirectory ports=80,443
OUT nsgr-apim-Outbound-116 prio=116 Allow dst=AzureConnectors ports=443
OUT nsgr-apim-Outbound-117 prio=117 Allow dst=SQL ports=1433
OUT nsgr-apim-Outbound-118 prio=118 Allow dst=AzureKeyVault ports=443
OUT nsgr-apim-Outbound-119 prio=119 Allow dst=AzureMonitor ports=443,12000,1886
OUT nsgr-apim-Outbound-120 prio=120 Allow dst=AzureCloud ports=443
IN NRMS-Rule-101 prio=101 Allow src=VirtualNetwork port=443
Thanks for sharing the full logs. That also covers the AzureLoadBalancer 6390 point; the default AllowAzureLoadBalancerInBound rule at priority 65001 already satisfies that requirement.
One thing in your dump is worth pulling on: those are four different subscriptions — 7e632f86, 97d91f75, 9c63c104, 71b904d0. Identical NSGs across them is expected from a shared template, but it also means the NSG layer can't reveal a per-subscription difference.
Security admin rules would. From the NSG overview: "Security admin rules always have a higher priority than network security group rules and thus are evaluated first… 'Deny' security admin rules block the traffic without delivering it to the destination." They come from Azure Virtual Network Manager, scoped separately from the NSG and invisible in an NSG dump. Is AVNM applied consistently across all four subscriptions?
Given NRMS-Rule-101 looks like a governed baseline, it's worth comparing the effective rules directly rather than assuming. This returns them per VNet, so you can run it against each stamp and diff:
az network manager list-effective-security-admin-rule --resource-group rg-mh-bhm07-prd-itn --virtual-network-name vnet-mh-bhm07-prd-itn --subscription <subscription-id>
Then the same for bhm08–bhm10 with their own subscription IDs. If bhm07 returns a different rule set to the others, that's your difference — and it's one an NSG comparison would never have shown.
One thing aside, unrelated to why bhm07 differs: is that inbound list filtered? It shows a single rule, VirtualNetwork on 443, which only duplicates the default. If that's the complete set, ApiManagement → 3443, Internet → 443 and AzureTrafficManager → 443 would all be denied on every stamp including bhm07 — so probably a filtered view, but worth confirming.
Please check once and confirm if this helps here.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
I queried the effective security-admin rules for both the primary Italy North VNet and the Canada East scaffold VNet in each of bhm07 , bhm08 , bhm09 , and bhm10, eight VNets across four subscriptions. Every query returned:
Effective security admin rules: 0
Therefore, AVNM is not applying a hidden Deny , Allow , or AlwaysAllow rule, and there is no per-subscription AVNM difference between the successful control and affected stamps.
You were correct that the earlier output was filtered; it was not the complete inbound list. I subsequently exported all custom and default inbound rules.
The primary NSGs for bhm07–bhm10 all explicitly contain the same required rules:
AzureFrontDoor.Backend -> TCP 443
ApiManagement -> TCP 3443
AzureLoadBalancer -> TCP 6390
AzureTrafficManager -> TCP 443
They also contain the same NRMS baseline and default NSG rules. ARM returns the rules in different array orders, but their names, priorities, access, direction, sources, destinations, protocols, and ports are identical.
We also confirmed the following:
• These are classic Premium services in External VNet mode.
• The primary NSGs use global Storage , SQL , AzureActiveDirectory , AzureKeyVault , AzureMonitor , and AzureCloud outbound service tags.
• There is no custom outbound deny.
• The global tags already cover Italy North and Canada East, so regional variants would be redundant.
• The Canada East scaffold NSGs are semantically identical across successful and failed APIM roles.
• There is no custom DNS, UDR, NAT gateway, firewall/NVA path, subnet lock, or unresolved policy-remediation failure.
• bhm07 succeeded with the same effective network controls.
• bhm08-query has failed repeatedly in sequential retries
At this point, neither ordinary NSG rules nor AVNM security-admin rules explain the selective failures.
@SHOUMIK CHAKRAVARTY , can we get someone from product team to take a look? This issue is completely blocking a high-priority SFI infrastructure update.
Hello @Max Kryatov - I am trying to see if I can get some help here through internal channels.
Hi @Mohammad Altaf - Do you have any further updates here? Flagging that this has since been described as blocking an SFI update.
Additionally to ITN region, exactly the same issue is observed in SEC region as well:
bhm03 Failed 00:18:42 [apim-query-mh-bhm03-prd-sec] Async poll failed: 400 { "error": { "code": "UpdateApiServiceFailed", "subCode": null, "message": "Unable to Update API service with vnet injection at this time. Please make sure the all the requirements are met as specified in the doc https://aka.ms/apimvnet. Otherwise, please open a support case for your API management service using the Azure portal.Please provide correlationId 4fc8d9a9-4d20-4dee-8e3f-e1d3ff18c1bb and TimeStamp 8/25/2026 4:14:10 AM.", "details": null, "innerError": null } }
We have received an update from our engineering team.
The APIM VNet Injection update failure is caused by an Azure Regional Compute Core quota limitation in the Canada East region. The current subscription quota is 100 cores, with 96 cores already in use, while the update requires an additional 8 cores. As a result, the deployment exceeds the approved quota and fails.
To proceed, please increase the Regional Core quota in Canada East to at least 104 cores (or higher) and then retry the APIM update.
Thank you!
Hi @Max Kryatov - If this has helped resolve your issue, please consider accepting the answer. If not, feel free to reply with more details.