Website issues occur in flex consumption plan with virtual network integration

Question

Website issues occur in flex consumption plan with virtual network integration

Chaya 5

What we want to achieve

In Azure Functions (flex consumption plan), we want to open the Functions website (https://{Functions Name}.azurewebsites.net) in the state that virtual network integration is configured.

■ Event

When opening the Functions website, a screen with the text “The service is unavailable” is displayed.

However, when the virtual network integration is disconnected, a normal screen is displayed. スクリーンショット 2025-03-28 151525

■Error Messages

◆Open the Troubleshooting Tools > Diagnostic Tools > Network/Connectivity Troubleshooter and select Connectivity issues, and you will see the following error message for virtual network integration. The following error occurs for virtual network integration.

▼ Error message

VNet integration is not healthy スクリーンショット 2025-03-28 150154

◆Open the Troubleshooting Tools > Diagnostic Tools > Network/Connectivity Troubleshooter and select Configuration issues. The following error occurs for virtual network integration.

▼ Error message

Subnet 'snet-03' is not valid for integration with App '{Functions Name}'

Subnet snet-03 is owned by App Service Plan undefined and cannot be used for Regional VNet integration by App Service Plan asp-02 which hosts the app { Functions Name}. スクリーンショット 2025-03-28 150419 *asp-02 is an App Service Plan created at the same time when Functions are created.

◆The configuration screen for virtual network integration in Functions is as follows. スクリーンショット 2025-03-28 150737

◆The setting values for the subnets subject to virtual network integration are as follows.

スクリーンショット 2025-03-28 150908

スクリーンショット 2025-03-28 151156

スクリーンショット 2025-03-28 151326

■Reference Information

https://learn.microsoft.com/ja-jp/azure/azure-functions/functions-networking-options?tabs=azure-portal#enable-virtual-network-integration

Andriy Bilous 12,096 Reputation points MVP

2025-03-29T08:01:38.63+00:00
Hello Chaya

There could be multiple reason of the described error:
What I see from your screenshots:

Subnet Delegation Issue:

The error means that the subnet snet-03 is owned by an undefined App Service Plan and cannot be used for Regional VNet integration by the App Service Plan asp-02.

Subnet delegation must be explicitly set to Microsoft.Web/serverFarms for App Service Plan integration.

Flex Consumption Plan Limitations:

The Flex Consumption Plan has specific requirements for VNet integration, including the need for proper subnet delegation and resource provider registration.

Each subnet used for Regional VNet Integration in Azure App Service can only be associated with one App Service Plan. You're trying to use a subnet (snet-03) that's already associated with another (possibly deleted or undefined) App Service Plan. Azure still considers it "owned" by that previous plan. Remove Subnet Delegation manually

https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration#requirements
Chaya 5 Reputation points

2025-03-31T02:39:35.74+00:00

delete
Chaya 5 Reputation points

2025-03-31T02:42:13.57+00:00

delete
Chaya 5 Reputation points

2025-03-31T03:39:38.2266667+00:00

delete
Chaya 5 Reputation points

2025-03-31T04:51:56.39+00:00
Hello Andriy, Thank you for your response. I have a few clarifications regarding the subnet delegation issue:

I noticed that the documentation mentions setting the subnet delegation to Microsoft.App/environments instead of Microsoft.Web/serverFarms. Is my understanding correct on this point?

https://learn.microsoft.com/en-us/azure/azure-functions/flex-consumption-plan#considerations

I am aware that the Flex Consumption Plan cannot coexist with other VNet integrations.

Just to confirm, I deleted the subnet and set up a new VNet integration, but I still received the same error message.

I appreciate your assistance in resolving this issue.
Ranashekar Guda 2,905 Reputation points Moderator

2025-04-04T09:32:12.4566667+00:00

Hi @Andriy Bilous,

Could you please share your suggestions on @Chaya queries?
Nicholas Wanberg 5 Reputation points

2025-04-04T10:36:11.99+00:00

I don't know the cause of the problem either, but the configuration issue you're discussing is misleading. The configuration troubleshooter is meant to assess the health of a subnet before you connect to it, not after it's already configured. In this case, that's the error you get from connecting to the subnet and then checking the configuration of the subnet you're already connected to. I'm researching the same problem, and if I disconnect from the vnet and try the configuration on the same subnet, it will say that it is valid:

If you go ahead and reconnect and try again, you'll again get:

It's "invalid" only because something is already connected to it (I.e. the current app service plan).

You also cannot set a Flex plan's subnet to Microsoft.Web/serverFarms. Attempting to do so will produce an error and the subnet configuration will fail to save the change. Microsoft.App/environments is mandatory.
Nicholas Wanberg 5 Reputation points

2025-04-04T15:22:08.5066667+00:00

I looked through the configurations on a similar problem. I don't know if this is your solution or not, but:

A. Confirm that you're actually unable to access the private endpoint in code.

B. Note that using @Microsoft.KeyVault functionality in Azure Function environment variables does not respect vNet integration functionality (at least in flex consumption apps. I have not tried in premium).

C. Understand that the errors you're seeing are essentially meaningless. My vNet integration works fine, and I get the same feedback from the troubleshooter.

I hope this helped!
Ranashekar Guda 2,905 Reputation points Moderator

2025-04-07T11:12:35.7433333+00:00

Hi @Chaya,
Just checking in to see if the below answer provided by @Nicholas Wanberg helped.
Ranashekar Guda 2,905 Reputation points Moderator

2025-04-08T10:27:41.22+00:00

Hi @Chaya,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet.

1 answer

Your answer

Andriy Bilous 12,096 Reputation points MVP

2025-03-29T08:01:38.63+00:00

Hello Chaya

There could be multiple reason of the described error:
What I see from your screenshots:

Subnet Delegation Issue:

The error means that the subnet snet-03 is owned by an undefined App Service Plan and cannot be used for Regional VNet integration by the App Service Plan asp-02.

Subnet delegation must be explicitly set to Microsoft.Web/serverFarms for App Service Plan integration.

Flex Consumption Plan Limitations:

The Flex Consumption Plan has specific requirements for VNet integration, including the need for proper subnet delegation and resource provider registration.

Each subnet used for Regional VNet Integration in Azure App Service can only be associated with one App Service Plan. You're trying to use a subnet (snet-03) that's already associated with another (possibly deleted or undefined) App Service Plan. Azure still considers it "owned" by that previous plan. Remove Subnet Delegation manually

https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration#requirements
Chaya 5 Reputation points

2025-03-31T02:39:35.74+00:00

delete
Chaya 5 Reputation points

2025-03-31T02:42:13.57+00:00

delete
Chaya 5 Reputation points

2025-03-31T03:39:38.2266667+00:00

delete
Chaya 5 Reputation points

2025-03-31T04:51:56.39+00:00

Hello Andriy, Thank you for your response. I have a few clarifications regarding the subnet delegation issue:

I noticed that the documentation mentions setting the subnet delegation to Microsoft.App/environments instead of Microsoft.Web/serverFarms. Is my understanding correct on this point?

https://learn.microsoft.com/en-us/azure/azure-functions/flex-consumption-plan#considerations

I am aware that the Flex Consumption Plan cannot coexist with other VNet integrations.

Just to confirm, I deleted the subnet and set up a new VNet integration, but I still received the same error message.

I appreciate your assistance in resolving this issue.
Ranashekar Guda 2,905 Reputation points Moderator

2025-04-04T09:32:12.4566667+00:00

Hi @Andriy Bilous,

Could you please share your suggestions on @Chaya queries?
Nicholas Wanberg 5 Reputation points

2025-04-04T10:36:11.99+00:00

I don't know the cause of the problem either, but the configuration issue you're discussing is misleading. The configuration troubleshooter is meant to assess the health of a subnet before you connect to it, not after it's already configured. In this case, that's the error you get from connecting to the subnet and then checking the configuration of the subnet you're already connected to. I'm researching the same problem, and if I disconnect from the vnet and try the configuration on the same subnet, it will say that it is valid:

If you go ahead and reconnect and try again, you'll again get:

It's "invalid" only because something is already connected to it (I.e. the current app service plan).

You also cannot set a Flex plan's subnet to Microsoft.Web/serverFarms. Attempting to do so will produce an error and the subnet configuration will fail to save the change. Microsoft.App/environments is mandatory.
Nicholas Wanberg 5 Reputation points

2025-04-04T15:22:08.5066667+00:00

I looked through the configurations on a similar problem. I don't know if this is your solution or not, but:

A. Confirm that you're actually unable to access the private endpoint in code.

B. Note that using @Microsoft.KeyVault functionality in Azure Function environment variables does not respect vNet integration functionality (at least in flex consumption apps. I have not tried in premium).

C. Understand that the errors you're seeing are essentially meaningless. My vNet integration works fine, and I get the same feedback from the troubleshooter.

I hope this helped!
Ranashekar Guda 2,905 Reputation points Moderator

2025-04-07T11:12:35.7433333+00:00

Hi @Chaya,
Just checking in to see if the below answer provided by @Nicholas Wanberg helped.
Ranashekar Guda 2,905 Reputation points Moderator

2025-04-08T10:27:41.22+00:00

Hi @Chaya,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet.

Answer 1

Matt Hunt 0

Was there a resolution to this?

I am having the exact same issue. One /26 subnet delegated to /environments, one flex consumption function app & app service plan with vnet integration to this subnet.

I've enabled public access on inbound for the function app but also have VNET integration is unhealthy, stating the subnet is in used by an undefined app service plan - but this cannot be the case, as I am deploying the subnet, function app, and app service plan together.

0 comments

Share via

Website issues occur in flex consumption plan with virtual network integration

1 answer

Your answer