Unable to delete serviceAssociationLinks and then associated subnet/vnet

Hello,

Welcome to Microsoft Q&A,

Azure creates Service Association Links (SALs) to lock subnets when certain PaaS services integrate with them (like App Services, Network Profiles, Container Instances, etc.). These links block subnet deletion to prevent data corruption or orphaned configurations.

When "allowDelete": false, you're not allowed to remove the link yourself unless the owning service explicitly allows it. This often occurs when the parent resource is already deleted or orphaned, with no API path to cleanly remove it.

https://learn.microsoft.com/en-us/answers/questions/2284805/cannot-remove-serviceassociationlink-from-subnet-d

Common Fixes

1. Identify the SAL Dependency

      az network vnet subnet show \
   

--resource-group <RG>
--vnet-name <VNet>
--name <Subnet>
--query serviceAssociationLinks

   
   Identify which service type is linked (e.g., `Microsoft.Web`, `Microsoft.DBforMySQL`, `Microsoft.ContainerInstance`, etc.)[Microsoft Learn](https://learn.microsoft.com/en-us/answers/questions/5513807/unable-to-delete-subnet-due-to-service-association)
   
1. Remove Associated PaaS Resource or Recreate It

   - If the SAL was from an App Service or App Service Plan that has already been deleted, try recreating it (with the same name) in the same resource group, reintegrating it with the subnet, and then removing the VNet integration to allow SAL cleanup. 
   
   - This has worked for App Services, as demonstrated in a shared resolution:
   
1. Change Subnet Delegation to None In the Azure Portal, navigate to the subnet and change its delegation to None. This helps remove any enforced link. [Microsoft Learn](https://learn.microsoft.com/en-us/answers/questions/2260899/unable-to-delete-vnet-due-to-serviceassociationlin)

1. Delete Hidden Network Profiles List any existing network profiles and remove them (if applicable):

   ```dockerfile
   az network profile list --resource-group <RG> az network profile delete --ids <network-profile-id>

SALs from Container Instances or other services may leave behind hidden network profiles.

1. Attempt Direct Deletion via CLI If the SAL references a specific provider path, try deleting it directly:

      az resource delete \   --ids "/subscriptions/<subId>/resourceGroups/<rg>/providers/Microsoft.Network/virtualNetworks/<vnet>/subnets/<subnet>/providers/Microsoft.Web/serviceAssociationLinks/AppServiceLink" \   --api-version 2022-05-01
   

   Or for Container Instances:

      az resource delete \
   

--ids "/subscriptions/<subId>/resourceGroups/<rg>/providers/Microsoft.Network/virtualNetworks/<vnet>/subnets/<subnet>/providers/Microsoft.ContainerInstance/serviceAssociationLinks/default"
--api-version 2018-10-01

   
If none of the above methods are effective, that's likely because the SAL was created by a service that no longer exists, or it's otherwise orphaned. The only way to resolve the issue currently is to open a support ticket, so manual removal by the Microsoft backend is required.

*Please Upvote and accept the answer if it helps!!*

I could solve this by deleting the network resource settings.

az resource delete -g <rg name> --name <network setting resource name> --resource-type 'GitHub.Network/networkSettings' --api-version <api version>