Azure Cloud Shell Private VNet cannot be deleted — orphaned acisal references Microsoft-managed ACI

Question

Azure Cloud Shell Private VNet cannot be deleted — orphaned acisal references Microsoft-managed ACI

Gustavo 0

I am trying to decommission an Azure Cloud Shell private networking environment.

All resources have been deleted except the Virtual Network and Network Security Group.

The VNet and its subnets are in Failed provisioning state. The cloudshell-containers subnet still has a Service Association Link named acisal.

Attempting to delete the link through the Microsoft.ContainerInstance API returns SubnetInUse, referencing a container group in a different subscription (cag-westeurope-1), apparently managed by the Cloud Shell service.

No container groups remain in my subscription. Subnet updates also fail with SubnetCannotGetUpdatedWhenParentVnetDeletionWasAttemptedEarlier.

I have a Basic Azure support plan and cannot open a technical support ticket.

Could a Microsoft engineer help escalate this orphaned ACI dependency for backend cleanup, or identify a supported recovery procedure?

I can provide the resource IDs and correlation ID privately if required.

Gustavo 0 Reputation points

2026-11-05T03:03:14.21+00:00

I have confirmed that ipConfigurationProfiles is null, so there are no legacy network profiles associated with the subnet.

The ACI Service Association Link removal was already attempted using the documented extension resource path with API versions 2018-10-01 and 2026-07-01.

The latter returned SubnetInUse, referencing a container group in another Azure subscription, outside my administrative control.

The subnet remains in Failed state with the acisal association present.

Since there are no remaining container groups in my subscription, could this issue be escalated to the Azure Container Instances / Cloud Shell engineering team for backend dependency cleanup?

My Azure Basic support plan does not permit technical support requests.

Your answer

Gustavo 0 Reputation points

2026-11-05T03:03:14.21+00:00

I have confirmed that ipConfigurationProfiles is null, so there are no legacy network profiles associated with the subnet.

The ACI Service Association Link removal was already attempted using the documented extension resource path with API versions 2018-10-01 and 2026-07-01.

The latter returned SubnetInUse, referencing a container group in another Azure subscription, outside my administrative control.

The subnet remains in Failed state with the acisal association present.

Since there are no remaining container groups in my subscription, could this issue be escalated to the Azure Container Instances / Cloud Shell engineering team for backend dependency cleanup?

My Azure Basic support plan does not permit technical support requests.