Unable to remove subnet delegation / delete subnet due to orphaned Service Association Link (legionservicelink) after Azure AI Foundry VNet integration

Question

Hello,

I am testing Azure AI Foundry network integration and I encountered an issue where I cannot remove a subnet delegation or delete the subnet.

Environment

• Azure subscription: Free trial
• Resource group: rg-kumano
• Virtual network: vnet-kumano
• Subnet: subnet-192-255

I created an Azure AI Foundry resource with VNet integration. After testing, I deleted the Azure AI Foundry resources by deleting the resource group.

However, the subnet remains undeletable.

The subnet still has the following delegation:

Microsoft.App/environments

and a Service Association Link:

serviceAssociationLinks/legionservicelink

When I try to remove the delegation, I get the following error:

Subnet /subscriptions/8de3116a-e1e1-4c5d-98cb-3ae57fc2ad2d/resourceGroups/rg-kumano/providers/Microsoft.Network/virtualNetworks/kumano/subnets/subnet-192-255 requires any of the following delegation(s) [Microsoft.App/environments] to reference service association link /subscriptions/8de3116a-e1e1-4c5d-98cb-3ae57fc2ad2d/resourceGroups/rg-kumano/providers/Microsoft.Network/virtualNetworks/kumano/subnets/subnet-192-255/serviceAssociationLinks/legionservicelink. Those delegations are either missing or getting deleted from subnet.

When I try to delete the subnet, I get:

(InUseSubnetCannotBeDeleted)
Subnet subnet-192-255 is in use by .../serviceAssociationLinks/legionservicelink and cannot be deleted.

I also checked whether the related resource still exists:

az resource list \
  --resource-type Microsoft.App/environments \
  -o json

Result:

[]

There is no existing Microsoft.App/environments resource in my subscription.

I also checked:

az resource list \
  --query "[?contains(type, 'Microsoft.App')]" \
  -o table

but no related resources were found.

The subnet information shows:

"delegations": [
  {
    "serviceName": "Microsoft.App/environments"
  }
],
"serviceAssociationLinks": [
  {
    "name": "legionservicelink",
    "allowDelete": false,
    "linkedResourceType": "Microsoft.App/environments"
  }
]

It seems that an orphaned Service Association Link remains after deleting Azure AI Foundry resources.

Could anyone advise how to remove this Service Association Link or recover the subnet so that it can be deleted?

Thank you.

Answer 1

What you’re seeing is a service-managed Service Association Link, not a normal delegation that can be removed independently. The allowDelete: false flag means do not try to delete legionservicelink directly or force a subnet update; the link must be released by the owning Microsoft.App/environments resource provider.

First, verify at subscription scope, including other resource groups, that no Container Apps managed environment remains. Inspect the subnet’s serviceAssociationLinks, delegations, ipConfigurations, and privateEndpoints as well. If nothing remains, wait 10–15 minutes after the deletion and retry deleting the subnet—platform cleanup is asynchronous. Only after the link is gone should you remove the delegation or delete the subnet.

Because yours still references Microsoft.App/environments but the environment is gone, treat it as orphaned if it persists. Open an Azure support request with the full subnet resource ID, legionservicelink details, resource-list output, and exact errors. Ask for provider-side cleanup of the orphaned SAL.