Unable to delete Container App Environment which status shows as "Scheduled for Delete"

Question

Unable to delete Container App Environment which status shows as "Scheduled for Delete"

Karthic Ganesan 20

1st iteration of Terraform Apply: Deployed Container App environment with private endpoint along with 1 container app via 1 and container app failed to instantiate due image pull failure.
2nd iteration of Terraform Apply: Container App Environment went into the status "Scheduled for Delete" because, it tried to delete the empty container app environment. During this iteration, its managed resource group and private endpoint got successfully deleted except the Container App Environment.
Tried deleting this container app environment manually using Azure Portal UI and Az CLI, but no success. Even if I tried to delete the entire resource group, resource group vanishes for 30 mins only and it comes back after (weir
Tried to delete its container app environment subnet with delegation Microsoft.App/environments and that is failing because it has associated with serviceAssociationLinks/legionservicelink which has "allowDelete: false".

So only way to delete these orphaned resources through backend. Unfortunately we have only Basic support plan, hence I can's raise support request. Could someone from Microsoft Support team help here to delete these container app environment and service link at backend? I will send the subscription and resource details in private.

Pashikanti Kumar 1,725 Reputation points Microsoft External Staff Moderator

2025-11-26T23:11:59.52+00:00

Hi Karthic Ganesan

Thanks for reaching out on Microsoft Q&A.

When Azure Container App Environment deletion is stuck and you cannot delete the associated Virtual Network because it hosts other subnets or services, the root cause is typically dependencies and Deny assignments on the managed resources created by Azure for the Container App Environment.

The Container App Environment creates a managed resource group with infrastructure components protected by Deny assignments that prevent manual deletion, even through CLI or Terraform. These deny assignments safeguard resources needed by the environment and block deletion unless the environment and related services are fully cleaned up by the backend.

Since the Virtual Network and subnet are shared by other services, deleting them independently is blocked to avoid breaking dependencies. You must first delete all dependent resources and then clean up the environment fully.

Manual deletion via Az CLI or Portal will fail in this blocked state; force delete commands won't bypass deny assignments because this is a backend consistency issue rather than a user error.

The only practical solution is to raise a support request with Microsoft Azure Support asking for a backend "force delete" to remove stuck Container App Environment, associated managed resource group, and underlying infrastructure gracefully, including service association links and subnets. You must provide all resource identifiers and a clear explanation of dependencies.

If you only have Basic support plan and cannot open such a request, escalate through your organization's Azure subscription or account team, or upgrade to a support plan providing this level of backend intervention.

Ensure you document the exact resource IDs, resource group names (including the managed group), subscription ID, and state details when contacting support, to speed up processing.
Pravallika KV 3,955 Reputation points Microsoft External Staff Moderator

2025-11-27T02:33:16.6566667+00:00

Hi @Karthic Ganesan , following up to see if you got a chance to check the above response and if it was helpful. If you have any further queries, please do let us know.
Karthic Ganesan 20 Reputation points

2025-11-27T07:48:18.8366667+00:00

Hi, I am a consultant, and this has happened in one of our German client tenant hence We don't have any control over in changing the support plan. Are there any other way to delete these resources in the backend? Your help here will be grateful.
Karthic Ganesan 20 Reputation points

2025-11-27T16:36:46.5166667+00:00

Hi Siddhesh Desai, Your az rest command did the trick. As soon as I've deleted the serviceAssociationLinks using above az rest command, container app environment also deleted automatically (might be because it's status was "Schedule for Delete").

Thanks a lot!
Pravallika KV 3,955 Reputation points Microsoft External Staff Moderator

2025-11-28T01:05:34.4433333+00:00

Thanks for the confirmation @Karthic Ganesan . Please click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you.

Answer accepted by question author

1 additional answer

Your answer

Pravallika KV 3,955 Reputation points Microsoft External Staff Moderator

2025-11-27T02:33:16.6566667+00:00

Hi @Karthic Ganesan , following up to see if you got a chance to check the above response and if it was helpful. If you have any further queries, please do let us know.
Karthic Ganesan 20 Reputation points

2025-11-27T07:48:18.8366667+00:00

Hi, I am a consultant, and this has happened in one of our German client tenant hence We don't have any control over in changing the support plan. Are there any other way to delete these resources in the backend? Your help here will be grateful.
Karthic Ganesan 20 Reputation points

2025-11-27T16:36:46.5166667+00:00

Hi Siddhesh Desai, Your az rest command did the trick. As soon as I've deleted the serviceAssociationLinks using above az rest command, container app environment also deleted automatically (might be because it's status was "Schedule for Delete").

Thanks a lot!
Pravallika KV 3,955 Reputation points Microsoft External Staff Moderator

2025-11-28T01:05:34.4433333+00:00

Thanks for the confirmation @Karthic Ganesan . Please click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you.

Answer 1

Hi Karthic Ganesan,

Did you try deleting the v-net, subnet and container app using terraform destroy command?

Also, can you use below cli command:

You can first delete the Service Association links on the V-Net by using this command:

Azure CLI

az rest --method delete --uri https://management.azure.com/subscriptions/<subscription id>/resourceGroups/<resource group>/providers/Microsoft.Network/virtualNetworks/<vnet name>/subnets/<subnet name>/providers/Microsoft.ContainerInstance/serviceAssociationLinks/default?api-version=2018-10-01

And then remove subnet-delegation by using the command below:

Azure CLI

az network vnet subnet update --resource-group <resource group name> --name <subnet name> --vnet-name <vnet name> --remove delegations

Ref: https://sathyasays.com/2021/06/05/delete-azure-vnet-subnet-delegation/

After the associations and delegations are removed, Retry the deletion of the V-NET and container app.

Answer 2

Karthic Ganesan 20

Your Bot suggested me to delete the Container App Environment and its Virtual Network via Az CLI commands. As I stated in Question, Az CLI based Container App Environment is failing and I can't delete the Virtual Network because it has been shared by other services via its other subnets.

Siddhesh Desai 735 Reputation points Microsoft External Staff Moderator

2025-11-27T13:11:21.54+00:00
Hi Karthic Ganesan,

Did you try deleting the v-net, subnet and container app using terraform destroy command?

Also, can you use below cli command:

You can first delete the Service Association links on the V-Net by using this command:

az rest --method delete --uri https://management.azure.com/subscriptions/<subscription id>/resourceGroups/<resource group>/providers/Microsoft.Network/virtualNetworks/<vnet name>/subnets/<subnet name>/providers/Microsoft.ContainerInstance/serviceAssociationLinks/default?api-version=2018-10-01

And then remove subnet-delegation by using the command below:

az network vnet subnet update --resource-group <resource group name> --name <subnet name> --vnet-name <vnet name> --remove delegations

Ref: https://sathyasays.com/2021/06/05/delete-azure-vnet-subnet-delegation/

After the associations and delegations are removed, Retry the deletion of the V-NET and container app.

Share via

Unable to delete Container App Environment which status shows as "Scheduled for Delete"

1 additional answer

Your answer