Error deleting firewall resource

Question

Error deleting firewall resource

Varsha Jain 20 Microsoft Employee

I am trying to delete firewall resource but I get below error: The subscription it's pointing to in the error message is something I don't have access to.

Error details

firewall-vnet-2ekoy24jbaaxi: Subnet AzureFirewallSubnet is in use ... and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet. See aka.ms/deletesubnet. (Code: InUseSubnetCannotBeDeleted)

Vinayteja Lellela 90 Reputation points Microsoft External Staff Moderator

2026-06-29T17:36:56.8466667+00:00
Hello Varsha Jain,

That error usually means the AzureFirewallSubnet can’t be removed because something is still attached to (or using) that subnet.

From the error text:

Subnet AzureFirewallSubnet is in use ... cannot be deleted

In order to delete the subnet, delete all the resources within the subnet

Code: InUseSubnetCannotBeDeleted

What to do

Identify what’s still in the AzureFirewallSubnet

This is typically the Azure Firewall itself and/or other networking resources that depend on that subnet.

Delete (or disassociate) those dependent resources first

Per the message, you must delete all resources within the subnet before deleting the subnet.

Delete the Azure Firewall and its associated resources

You can delete the firewall using the Azure portal, Azure CLI, or PowerShell (including the relevant remove cmdlets for Azure Firewall).

If you’re deleting an Azure Firewall policy and see related delete failures

A common blocker is resource locks or dependencies on the policy. In that case, check the policy’s Locks in the portal and remove any Read-Only or Delete locks, and confirm there are no dependent rules/resources preventing deletion.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Varsha Jain 20 Reputation points Microsoft Employee

2026-06-29T17:40:12.36+00:00

hi, thanks for you response. However, the underlying resource still using this firewall is in a subscription that I don't have access to and is not owned by our service/team. I would need help to delete this as this is the only resource that's preventing me from deprecating the subscription on portal. Let me know if you need complete error message.
Varsha Jain 20 Reputation points Microsoft Employee

2026-06-30T00:44:11.21+00:00

Thanks but I don't see the subscription on portal. I don't know which team owns this sub.

Answer accepted by question author

Vinayteja Lellela 90 Microsoft External Staff Moderator

Hello Varsha Jain,

Thank you for the clarification.

Based on the details you’ve shared, this behavior typically indicates that the AzureFirewallSubnet is still associated with a dependent resource that exists outside your current subscription.

Even though you don’t have access to that subscription, Azure continues to treat the subnet as “in use” because it is referenced by another resource (for example, Azure Firewall, Private Endpoint, or a service integration). As a result, the platform prevents deletion of the subnet.

What this means

The dependency is likely cross-subscription or part of a shared networking setup.
The blocking resource is not visible or manageable from your subscription.
In some cases, this could also be due to a Service Association Link (SAL) or an orphaned backend reference created by another Azure service.

Recommended action

Since the dependent resource exists outside your scope, the issue cannot be resolved directly from your end.

You may proceed with one of the following:

Reach out to the owning team of the other subscription

Request them to remove or detach the resource that is using the subnet.

Azure enforces that all resources using a subnet must be removed before the subnet (and associated resources like Azure Firewall) can be deleted. When those dependencies exist in another subscription, manual cleanup is not possible from your side.

If this answers your question, feel free to click**“Upvote”**, which may help other community members facing similar scenarios.

0 comments

1 additional answer

Your answer

Vinayteja Lellela 90 Reputation points Microsoft External Staff Moderator

2026-06-29T17:36:56.8466667+00:00

Hello Varsha Jain,

That error usually means the AzureFirewallSubnet can’t be removed because something is still attached to (or using) that subnet.

From the error text:

Subnet AzureFirewallSubnet is in use ... cannot be deleted

In order to delete the subnet, delete all the resources within the subnet

Code: InUseSubnetCannotBeDeleted

What to do

Identify what’s still in the AzureFirewallSubnet

This is typically the Azure Firewall itself and/or other networking resources that depend on that subnet.

Delete (or disassociate) those dependent resources first

Per the message, you must delete all resources within the subnet before deleting the subnet.

Delete the Azure Firewall and its associated resources

You can delete the firewall using the Azure portal, Azure CLI, or PowerShell (including the relevant remove cmdlets for Azure Firewall).

If you’re deleting an Azure Firewall policy and see related delete failures

A common blocker is resource locks or dependencies on the policy. In that case, check the policy’s Locks in the portal and remove any Read-Only or Delete locks, and confirm there are no dependent rules/resources preventing deletion.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Varsha Jain 20 Reputation points Microsoft Employee

2026-06-29T17:40:12.36+00:00

hi, thanks for you response. However, the underlying resource still using this firewall is in a subscription that I don't have access to and is not owned by our service/team. I would need help to delete this as this is the only resource that's preventing me from deprecating the subscription on portal. Let me know if you need complete error message.
Varsha Jain 20 Reputation points Microsoft Employee

2026-06-30T00:44:11.21+00:00

Thanks but I don't see the subscription on portal. I don't know which team owns this sub.

Answer 1

hi Varsha Jain & thx for sharing urs issue here at Q&A portal,

That error means the firewall itself or a related resource is still attached to AzureFirewallSubnet. Azure won’t delete the subnet while anything is using it. The confusing part is the resource ID may point to another subscription, which usually means a linked/managed resource, old firewall association, route table, policy, or orphaned NIC/private IP reference is still there. Check the subnet’s connected resources

az network vnet subnet show \

-g <rg> \

--vnet-name <vnet> \

-n AzureFirewallSubnet \

--query "ipConfigurations"

& the firewall resource az network firewall list -g <rg> -o table

If the subnet still shows an IP configuration from a resource in a subscription u can’t access, u’ll need someone w/ access to that subscription or Microsoft Support to remove the stale backend reference.

So delete or detach whatever is still using AzureFirewallSubnet first. If the dependency is orphaned or in a subscription u can’t access, this needs Azure Networking support cleanup.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/