Orphaned PowerPlatformSAL blocking VNet/Subnet deletion

Question

Orphaned PowerPlatformSAL blocking VNet/Subnet deletion

Jeffery Scully 0

Resource ID: /subscriptions/cdaf5f68-c7f4-4cd1-aab8-9483328f3b77/resourceGroups/lakebrook-eu-poc/providers/Microsoft.Network/virtualNetworks/sql-mirror-eu-vnet/subnets/gateway-subnet/serviceAssociationLinks/PowerPlatformSAL

Error: UnauthorizedClientApplication for App ID b677c290-cf4b-4a8e-a60e-91ba650a4abe

Dio Xavier 292.7K Reputation points Volunteer Moderator

2026-07-27T22:57:22.0666667+00:00

Hola

Bienvenido a la comunidad de Microsoft Azure

Buenas noches. Gracias por contactarnos. Necesitamos que reformule su pregunta y explique con más detalle el problema que está experimentando con la red virtual/subred.
Jeffery Scully 0 Reputation points

2026-07-27T23:01:40.6166667+00:00

I cannot delete subnet because of the serviceAssociationLinks/PowerPlatformSAL error. I also tried to removed it's subnet delegation, which also errored. We don't have a PowerPlatform that has any active connections to the VPC. We need microsoft to remove the SAL block, or whatever is needed.
Arun(AJ) V 0 Reputation points

2026-07-27T23:25:36.28+00:00
@Jeffery Scully try below approach

Please open an Azure Support request under Azure Virtual Network / Networking and request backend removal of the orphaned PowerPlatformSAL and associated subnet delegation. Include:

The full SAL resource ID

Subscription ID, resource group, VNet, and subnet name

The exact UnauthorizedClientApplication error and App ID

The error received when removing the subnet delegation

Confirmation that there are no active Power Platform VNet gateways or integrations

Output from az network vnet subnet show showing the remaining serviceAssociationLinks and delegations

After Support removes the orphaned SAL, retry removing the delegation and deleting the subnet. Microsoft Support is the appropriate path when an orphaned service-managed SAL cannot be removed through the portal, CLI, or Power Platform administration experience.

1 answer

Your answer

Dio Xavier 292.7K Reputation points Volunteer Moderator

2026-07-27T22:57:22.0666667+00:00

Hola

Bienvenido a la comunidad de Microsoft Azure

Buenas noches. Gracias por contactarnos. Necesitamos que reformule su pregunta y explique con más detalle el problema que está experimentando con la red virtual/subred.
Jeffery Scully 0 Reputation points

2026-07-27T23:01:40.6166667+00:00

I cannot delete subnet because of the serviceAssociationLinks/PowerPlatformSAL error. I also tried to removed it's subnet delegation, which also errored. We don't have a PowerPlatform that has any active connections to the VPC. We need microsoft to remove the SAL block, or whatever is needed.
Arun(AJ) V 0 Reputation points

2026-07-27T23:25:36.28+00:00

@Jeffery Scully try below approach

Please open an Azure Support request under Azure Virtual Network / Networking and request backend removal of the orphaned PowerPlatformSAL and associated subnet delegation. Include:

The full SAL resource ID

Subscription ID, resource group, VNet, and subnet name

The exact UnauthorizedClientApplication error and App ID

The error received when removing the subnet delegation

Confirmation that there are no active Power Platform VNet gateways or integrations

Output from az network vnet subnet show showing the remaining serviceAssociationLinks and delegations

After Support removes the orphaned SAL, retry removing the delegation and deleting the subnet. Microsoft Support is the appropriate path when an orphaned service-managed SAL cannot be removed through the portal, CLI, or Power Platform administration experience.

Answer 1

Hi @Jeffery Scully

PowerPlatformSAL is a Service Association Link (SAL) on the subnet. Azure does not allow a subnet or its parent VNet to be deleted while a service association link is present. The related Power Platform resource or VNet integration must be removed first.

Please first confirm that the Power Platform VNet data gateway, Power BI/Power Platform network integration, and any other resource that used this subnet have been deleted or disconnected. Also check whether the subnet still has a delegation or any remaining IP configurations:

az network vnet subnet show \

--subscription cdaf5f68-c7f4-4cd1-aab8-9483328f3b77 \

--resource-group lakebrook-eu-poc \

--vnet-name sql-mirror-eu-vnet \

--name gateway-subnet \

--query "{delegations:delegations,serviceAssociationLinks:serviceAssociationLinks,ipConfigurations:ipConfigurations}" \

--output json

If a Power Platform VNet data gateway is still associated with the subnet, remove the gateway association first. If the gateway was deleted but the PowerPlatformSAL persists, you can also consider creating a new VNet data gateway on the same subnet and then deleting it, which can cause the service to detect and remove a stale SAL.

If the SAL remains after all dependent resources are removed, do not attempt to force-delete it. Open an Azure Support request under Azure Virtual Network/Networking or Power Platform, and explicitly request backend removal of the orphaned PowerPlatformSAL. Include the full SAL resource ID, the UnauthorizedClientApplication error, the subscription/resource group/VNet/subnet details, the output of the command above, and the date on which the linked Power Platform resource was removed.

Thanks
Arun