Azure Function App: Attempting to delete a Flex Function App integrated with a VNet with a delete lock results in a non-descriptive error

[shellicar]

I was unsure where else to file this issue.

I recently ran into some issues where I was not able to delete Flex Function Apps after creating them.
I was attempting to test switching over to them from Consumption, and wanted to ensure my setup would work.
Whenever I would delete the Function Apps, they would become unresponsive.
Sometimes I was able to eventually delete them without knowing why.

After having the same issue occurr, and opening a support ticket, I had a realisation that it could be due to a delete lock on the VNet.
I have reproduced the issue by creating a VNet Flex Function App with a delete lock on the VNet.

When attempting to delete the function app through the Azure Portal, it simply states:

Failed to delete app 'sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e':
An error has occurred.

From that point onwards the Function App seems to enter a half deleted state, and seemingly becomes unresponsive.
Most operations, including Az Cli operations return HTTP Status 500.

Removing the Delete Lock from the Virtual Network will allow the Flex Function App to be deleted without any issue.

When testing if this occurred with an App Service VNet integrated function app, I observed the following error, as expected:

Failed to delete app 'sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e':
An operation on the Virtual Network has failed. Details:
{
  "error": {
    "code": "ScopeLocked",
    "message": "The scope '/subscriptions/8c39c8f0-3f9c-40f0-a6e7-35b976b03c58/resourceGroups/sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e/providers/Microsoft.Network/virtualNetworks/sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e/subnets/AppsSubnet/serviceAssociationLinks/AppServiceLink' cannot perform delete operation because following scope(s) are locked: '/subscriptions/8c39c8f0-3f9c-40f0-a6e7-35b976b03c58/resourceGroups/sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e/providers/Microsoft.Network/virtualNetworks/sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e'. Please remove the lock and try again."
  }
}

Here is a sample trace when trying to delete the function app

az functionapp delete -n sandbox-1618a0c1-d497-4374-a82f-a471b9c17d14 -g sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e --debug

cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7f7feb20ff60>, <function OutputProducer.on_global_arguments at 0x7f7feb1c2160>, <function CLIQuery.on_global_arguments at 0x7f7feb1ffc40>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'functionapp': ['azure.cli.command_modules.appservice', 'azure.cli.command_modules.serviceconnector']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: appservice                0.408        79       270
cli.azure.cli.core: serviceconnector          0.482        20       309
cli.azure.cli.core: Total (2)                 0.889        99       579
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name                  Load Time    Groups  Commands  Directory
cli.azure.cli.core: Total (0)                 0.000         0         0
cli.azure.cli.core: Loaded 97 groups, 579 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : functionapp delete
cli.azure.cli.core: Command table: functionapp delete
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f7fea4a5d00>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/stephen/.azure/commands/2024-09-16.21-42-19.functionapp_delete.1243539.log'.
az_command_data_logger: command args: functionapp delete -n {} -g {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x7f7fea4e05e0>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x7f7fea2f2520>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x7f7fea2f2660>, <function register_upcoming_breaking_change_info.<locals>.update_breaking_change_info at 0x7f7fea2f2700>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f7feb1c2200>, <function CLIQuery.handle_query_parameter at 0x7f7feb1ffce0>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x7f7fea2f25c0>]
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=WebSiteManagementClient
cli.azure.cli.core.auth.persistence: build_persistence: location='/home/stephen/.azure/msal_token_cache.json', encrypt=False
cli.azure.cli.core.auth.binary_cache: load: /home/stephen/.azure/msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c
msal.authority: openid_config("https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/fe411ef2-1ab0-4366-aa88-a57367cf113c/kerberos', 'tenant_region_scope': 'OC', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? None
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
cli.azure.cli.core.auth.msal_authentication: UserCredential.get_token: scopes=('https://management.core.windows.net//.default',), claims=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: a821e560-e11e-425c-8a1c-3bbd2f7d4e41
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e/providers/Microsoft.Web/sites/sandbox-1618a0c1-d497-4374-a82f-a471b9c17d14?api-version=2023-01-01'
cli.azure.cli.core.sdk.policies: Request method: 'DELETE'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies:     'Accept': 'application/json'
cli.azure.cli.core.sdk.policies:     'x-ms-client-request-id': 'ba214a9b-7420-11ef-8d00-917868e49114'
cli.azure.cli.core.sdk.policies:     'CommandName': 'functionapp delete'
cli.azure.cli.core.sdk.policies:     'ParameterSetName': '-n -g --debug'
cli.azure.cli.core.sdk.policies:     'User-Agent': 'AZURECLI/2.64.0 (DEB) azsdk-python-core/1.28.0 Python/3.11.8 (Linux-5.15.150.1-microsoft-standard-WSL2-x86_64-with-glibc2.35)'
cli.azure.cli.core.sdk.policies:     'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "DELETE /subscriptions/{subscriptionId}/resourceGroups/sandbox-c61f503b-6ec8-4f11-9a88-a2a5b1ba497e/providers/Microsoft.Web/sites/sandbox-1618a0c1-d497-4374-a82f-a471b9c17d14?api-version=2023-01-01 HTTP/1.1" 500 36
cli.azure.cli.core.sdk.policies: Response status: 500
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies:     'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies:     'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies:     'Content-Length': '36'
cli.azure.cli.core.sdk.policies:     'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies:     'Expires': '-1'
cli.azure.cli.core.sdk.policies:     'ETag': '"1DB082CAD6F5720"'
cli.azure.cli.core.sdk.policies:     'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies:     'X-AspNet-Version': '4.0.30319'
cli.azure.cli.core.sdk.policies:     'X-Powered-By': 'ASP.NET'
cli.azure.cli.core.sdk.policies:     'x-ms-failure-cause': 'service'
cli.azure.cli.core.sdk.policies:     'x-ms-ratelimit-remaining-subscription-deletes': '399'
cli.azure.cli.core.sdk.policies:     'x-ms-ratelimit-remaining-subscription-global-deletes': '5999'
cli.azure.cli.core.sdk.policies:     'x-ms-request-id': 'f6b109b8-7c79-455b-a4a5-b6fab2753bb6'
cli.azure.cli.core.sdk.policies:     'x-ms-correlation-request-id': 'f6b109b8-7c79-455b-a4a5-b6fab2753bb6'
cli.azure.cli.core.sdk.policies:     'x-ms-routing-request-id': 'AUSTRALIAEAST:20240916T114224Z:f6b109b8-7c79-455b-a4a5-b6fab2753bb6'
cli.azure.cli.core.sdk.policies:     'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies:     'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies:     'X-MSEdge-Ref': 'Ref A: 467C22A4874446139885011BE7A30CB5 Ref B: SYD03EDGE2012 Ref C: 2024-09-16T11:42:19Z'
cli.azure.cli.core.sdk.policies:     'Date': 'Mon, 16 Sep 2024 11:42:23 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"Message":"An error has occurred."}```