I am deploying Azure Functions using the Flex Consumption SKU to a subnet on a virtual network. The subnet is delegated to Microsoft.App/environments and everything regarding the deployment works perfectly until I remove it and try to deploy it again.

For context, we have a development environment and each evening I tear it down to save costs, each morning I deploy the resources and everything works fine except with Flex Consumption apps. In specific regards to Function Apps I am using the following Azure CLI command to remove it, you'll note that I'm disconnecting it from the virtual net before removing the resource itself to ensure I'm not leaving it in a weird state:

az webapp vnet-integration remove --name $resource.name --resource-group $resourceGroup.name
az resource delete --ids $resource.id

Deploying the same Function App to the same subnet fails with the following error:

Internal Server Error

The error itself isn't particularly useful, but when you try to remove or edit the subnet you get a more useful error:

Failed to delete subnet 'xxxx'. Error: Subnet xxxx is in use by /subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.Network/virtualNetworks/xxxx/subnets/xxxx/serviceAssociationLinks/legionservicelink and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet. 

The resource it tells me is in use, legionservicelink, seems to be a hangover from the original linking to the Function App and isn't an actual resource governed by me as far as I can tell. I certainly can't find it in the subscription to remove it.

I've opened a ticket with Microsoft and they are suggesting I should remove the app from the network before I delete it, but you can see that I am.

Does anyone know how I remove the subnet once it's in this state? Obviously I need to remove anything using it first, but I can't find the resource to remove it.

EDIT

I have since found what I believe to be reproduceable steps to cause this bug - I still believe it's a bug because the same steps do not cause Logic Apps or other types of Function App to corrupt the subnet in way that renders them unable to be removed or edited. The scenario is actually linked to how the app is deployed via Bicep rather than it being torn down as I originally suspected.

Here are the steps I am following to create the app via Bicep:

1. Create a Function App with the Flex Consumption SKU using bicep
2. Attach the App to a subnet using bicep

The issue I'm seeing where the subnet is becoming corrupted is if you reapply those two steps without first removing the Function App from the subnet or deleting it - like I said this only seems to happen with Flex Apps. If we redeploy, the following happens when those steps are re-run:

1. Create a Function App with the Flex Consumption SKU using bicep

   Because I'm not specifying any networking at this point the Function App is updated and having its networking removed, therefore disconnecting it from the network - this is expected and intended. This is where I believe the issue exists, this is not in fact disconnecting it from the subnet correctly and leaves the subnet corrupted.

2. Attach the App to a subnet using bicep

   This step now fails because the subnet is still associated with the Function App, despite the Function App thinking it has been disconnected.

I have a workaround where I am simply disconnecting the Function App from the VNet using Azure CLI before running the Bicep script. I am however curious whether anyone else is seeing this issue when redeploying Flex Apps via Bicep?

I am deploying Azure Functions using the Flex Consumption SKU to a subnet on a virtual network. The subnet is delegated to Microsoft.App/environments and everything regarding the deployment works perfectly until I remove it and try to deploy it again.

For context, we have a development environment and each evening I tear it down to save costs, each morning I deploy the resources and everything works fine except with Flex Consumption apps. In specific regards to Function Apps I am using the following Azure CLI command to remove it, you'll note that I'm disconnecting it from the virtual net before removing the resource itself to ensure I'm not leaving it in a weird state:

az webapp vnet-integration remove --name $resource.name --resource-group $resourceGroup.name
az resource delete --ids $resource.id

Deploying the same Function App to the same subnet fails with the following error:

Internal Server Error

The error itself isn't particularly useful, but when you try to remove or edit the subnet you get a more useful error:

Failed to delete subnet 'xxxx'. Error: Subnet xxxx is in use by /subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.Network/virtualNetworks/xxxx/subnets/xxxx/serviceAssociationLinks/legionservicelink and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet. 

The resource it tells me is in use, legionservicelink, seems to be a hangover from the original linking to the Function App and isn't an actual resource governed by me as far as I can tell. I certainly can't find it in the subscription to remove it.

I've opened a ticket with Microsoft and they are suggesting I should remove the app from the network before I delete it, but you can see that I am.

Does anyone know how I remove the subnet once it's in this state? Obviously I need to remove anything using it first, but I can't find the resource to remove it.

EDIT

I have since found what I believe to be reproduceable steps to cause this bug - I still believe it's a bug because the same steps do not cause Logic Apps or other types of Function App to corrupt the subnet in way that renders them unable to be removed or edited. The scenario is actually linked to how the app is deployed via Bicep rather than it being torn down as I originally suspected.

Here are the steps I am following to create the app via Bicep:

1. Create a Function App with the Flex Consumption SKU using bicep
2. Attach the App to a subnet using bicep

The issue I'm seeing where the subnet is becoming corrupted is if you reapply those two steps without first removing the Function App from the subnet or deleting it - like I said this only seems to happen with Flex Apps. If we redeploy, the following happens when those steps are re-run:

1. Create a Function App with the Flex Consumption SKU using bicep

   Because I'm not specifying any networking at this point the Function App is updated and having its networking removed, therefore disconnecting it from the network - this is expected and intended. This is where I believe the issue exists, this is not in fact disconnecting it from the subnet correctly and leaves the subnet corrupted.

2. Attach the App to a subnet using bicep

   This step now fails because the subnet is still associated with the Function App, despite the Function App thinking it has been disconnected.

I have a workaround where I am simply disconnecting the Function App from the VNet using Azure CLI before running the Bicep script. I am however curious whether anyone else is seeing this issue when redeploying Flex Apps via Bicep?

• azure
• azure-functions
• azure-virtual-network

1 Answer 1

Failed to delete subnet 'xxxx'. Error: Subnet xxxx is in use by /subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.Network/virtualNetworks/xxxx/subnets/xxxx/serviceAssociationLinks/legionservicelink and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet.

The error your encountered due to service link associated to the subnet. Kindly check the subnet details using the cmdlet below.

az network vnet subnet show -g my-resource-group -n kamsubnet3 --vnet-name kamvnet3

Output :

• After removing the Function App, wait a few minutes before trying to delete or redeploy it to the subnet.

• If still service links are attached to subnet delete the delegation and wait few minutes to update the subnet properly.

• Check that the function app has been deleted before deleting the subnet or recreating it in the same subnet.

Once you've removed the delegation try deleting the subnet again or Create a function app in s`ame Subnet.

az network vnet subnet delete --name kamsubnet3 --resource-group my-resource-group --vnet-name kamvnet3

You can also use the PowerShell script below to automatically check each functionality.

$FunctionAppName = "kamVNsubfunc"
$ResourceGroupName = "resourceGroupName"
$SubnetName = "kamsubnet2"
$VNetName = "kamvnet2"
$FunctionAppResourceId = "FunctionAppResourceID"
 
Write-Output "Checking VNet integration for Function App: $FunctionAppName..."
$VNetIntegrationStatus = az webapp vnet-integration list --name $FunctionAppName --resource-group $ResourceGroupName --query "[0].id" -o tsv
 
if (-not [string]::IsNullOrEmpty($VNetIntegrationStatus)) {
    Write-Output "VNet integration is enabled. Removing VNet integration..."
    az webapp vnet-integration remove --name $FunctionAppName --resource-group $ResourceGroupName
    Start-Sleep -Seconds 10 
 
    $VNetIntegrationCheck = az webapp vnet-integration list --name $FunctionAppName --resource-group $ResourceGroupName --query "[0].id" -o tsv
    if (-not [string]::IsNullOrEmpty($VNetIntegrationCheck)) {
        Write-Output "Failed to remove VNet integration. Exiting..."
        exit 1
    } else {
        Write-Output "VNet integration has been successfully removed."
    }
 
    Write-Output "Removing Function App: $FunctionAppName..."
    az resource delete --ids $FunctionAppResourceId
    Start-Sleep -Seconds 10  
 
    Write-Output "Checking Service Association Links in subnet: $SubnetName..."
    $SubnetInfo = az network vnet subnet show -g $ResourceGroupName -n $SubnetName --vnet-name $VNetName | ConvertFrom-Json
 
    if ($SubnetInfo.serviceAssociationLinks -ne $null -and $SubnetInfo.serviceAssociationLinks.Count -gt 0) {
        Write-Output "Service Association Links found in the subnet:"
        $SubnetInfo.serviceAssociationLinks | ForEach-Object { 
            Write-Output " - Name: $($_.name), Linked Resource Type: $($_.linkedResourceType)" 
        }
 
        Write-Output "Removing delegations from the subnet: $SubnetName..."
        az network vnet subnet update `
            --resource-group $ResourceGroupName `
            --vnet-name $VNetName `
            --name $SubnetName `
            --remove delegations
        Write-Output "Delegations have been removed from the subnet."
 
        Write-Output "Removing the subnet: $SubnetName..."
        az network vnet subnet delete `
            --resource-group $ResourceGroupName `
            --vnet-name $VNetName `
            --name $SubnetName
        Write-Output "Subnet has been successfully removed."
    } else {
        Write-Output "No Service Association Links found in the subnet. Skipping delegation and subnet removal."
    }
} else {
    Write-Output "VNet integration is not enabled for the Function App."
}

Output :

Reference :

https://learn.microsoft.com/en-us/answers/questions/140197/unable-to-delete-vnet-due-to-serviceassociationlin By suvasara-MSFT