Azure-docs: New VNET Integration - HTTP 409 (Conflict)

[jscaravilli]

Trying to connect two app-services to two different subnets in the same vnet using preview integration. This was working about two weeks ago, but now results in the error:

Failed to add delegation to the existing subnet: Adding this VNET would exceed the App Service Plan VNET limit of 1. Looking at the request itself, I can see the PUT request returns with a 409 conflict error. Has something been altered in the way the API responds to this type of request? What can I do to workaround this issue until the problem is resolved?

When I look at the App Service Plan in question, it only has one VNET associated with it (the same VNET I'm trying to integrate now, only using a new subnet). I've have not yet reached the max (5) subnet integrations for the app service plan.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: a7a98803-1438-b1b5-f543-7dd88bc4294e
• Version Independent ID: 37ff1d0f-ed8e-5e4d-1f4c-1b9f6cffb938
• Content: Integrate app with Azure Virtual Network - Azure App Service
• Content Source: articles/app-service/web-sites-integrate-with-vnet.md
• Service: app-service
• GitHub Login: @ccompy
• Microsoft Alias: ccompy

[mimckitt]

@jscaravilli please provide us with the link to the documentation you are following so we can better assist.

[jscaravilli]

https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet

Specifically, the preview integration feature.

Something on the backend has changed with respect to the way the request is processed – that’s all I can ascertain at this time.

[mimckitt]

@jscaravilli thanks for that. I have assigned it to the correct engineer to take a look

[jscaravilli]

@MicahMcKittrick-MSFT , @BryanTrach-MSFT - additional info for you and the PG. It seems that I am now able to connect multiple app services to the same subnet via the preview vnet integration, Previously this wasn't possible (see: https://github.com/MicrosoftDocs/azure-docs/issues/29302 opened 2 months ago by DOMZE).

What is the expected/supported scenario here?
_you are the administrator for contoso.com_ :)

1. Multiple apps, each in their own subnet of the same vnet?
2. Multiple apps, each in the same subnet of the same vnet?

[jscaravilli]

Based on a support request response, this appears to be an poorly documented change in functionality.

I hope you are having a good [day]. Recently, I received an update from the Product Group regarding this support ticket. Mainly, Azure Networking team is currently rolling out a change to block more than 1 VNET connection (using new VNET feature) per VM. From our insight (Azure App Services), we had to update our end to also enforce this limit. Multiple apps in the same App Service Plan can connect to the same subnet though as under the covers this is just one VNET connection. We have already updated our docs to reflect this change, though it’s a bit unclear and the Azure Documentation team is already aware of this situation: https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet

[GreyKarnival]

@jscaravilli I'm having the same issue, so if I understand well, now you need to put all your webapps from the same App Service Plan in the same subnet ?
As opposed to before where you had to put one web app per subnet ?

[jscaravilli]

Correct. That's my understanding

---

From: Karny [e-mail]
Sent: Thursday, June 13, 2019 3:13:06 AM
To: MicrosoftDocs/azure-docs
Cc: jscaravilli; Mention
Subject: Re: [MicrosoftDocs/azure-docs] New VNET Integration - HTTP 409 (Conflict) (#32922)

@jscaravillihttps://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fjscaravilli&data=02%7C01%7Cjscaravilli%40hitachisolutions.com%7Ccf21169ee4dc46fc17d608d6efd6f9ca%7Ce85feadf11e747bba16043b98dcc96f1%7C0%7C0%7C636960103941398588&sdata=lNuSpkhLfs%2Ft39rVpH%2BjBFyUaAk83an9l7ZA9yGua7s%3D&reserved=0 I'm having the same issue, so if I understand well, now you need to put all your webapps from the same App Service Plan in the same subnet ?
As opposed to before where you had to put one web app per subnet ?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fissues%2F32922%3Femail_source%3Dnotifications%26email_token%3DAKYUEY322F4N2J57FSU6N7LP2H6RFA5CNFSM4HVXGSW2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODXS4VDY%23issuecomment-501598863&data=02%7C01%7Cjscaravilli%40hitachisolutions.com%7Ccf21169ee4dc46fc17d608d6efd6f9ca%7Ce85feadf11e747bba16043b98dcc96f1%7C0%7C0%7C636960103941398588&sdata=9%2FEEsxpoSWi8S4C8Om7VH5T2GkNdcjIiG%2FflldSXK8k%3D&reserved=0, or mute the threadhttps://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAKYUEY7GQDREJQZKXHG5X2TP2H6RFANCNFSM4HVXGSWQ&data=02%7C01%7Cjscaravilli%40hitachisolutions.com%7Ccf21169ee4dc46fc17d608d6efd6f9ca%7Ce85feadf11e747bba16043b98dcc96f1%7C0%7C0%7C636960103941408581&sdata=b2xHtTInF%2F2wAyG7Vnr4o8ChLFsKRls2ILjAmhJC7O4%3D&reserved=0.

This e-mail is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. Any review, dissemination, copying, printing or other use of this e-mail by persons or entities other than the addressee is prohibited. If you have received this e-mail in error, please contact the sender immediately and delete this e-mail and any attachments from any device.

[BryanTrach-MSFT]

@jscaravilli and @GreyKarnival We apologize for the confusion and frustration that you have encountered. I have verified they are looking into additional doc edits to help make this recent change more clear. The changes should be live in the coming weeks.

We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

[psallis]

hi @BryanTrach-MSFT i'm still hitting an issue. I have two App Plans and one vnet. One plan is connected on sub-net-1 and i'm trying to connect a second app to sub-net-2. However, I get this error

Failed to add delegation to the existing subnet:
Adding this VNET would exceed the App Service Plan VNET limit of 1.

[sharushetty]

I had exactly the same issue posted by @jscaravilli at the very beginning of this thread. TO be more clear, this is how we had planned to lay down our apps:

1. App Service Plan 1
   a. VNet1
   i. Subnet1 --> App1
   ii. Subnet2 --> App2
   iii. Subnet3 --> App3
   iv. Subnet4 --> App4

This seemed to work for us some time back, but not anymore and hence I had reached out to Microsoft to make sure if the above configuration is even supported any longer and they came back saying we cannot have more than 1 subnet in the above setup. In other words, the above configuration needs to be update as below:

1. App Service Plan 1
   a. VNet1
   i. Subnet1 --> App1
   ii. Subnet1 --> App2
   iii. Subnet1 --> App3
   iv. Subnet1 --> App4

Hope this helps clarify some of the confusions.

[kristianGNI]

hi @BryanTrach-MSFT

Have the same issue,

App Service Plan
VNet
Subnet1 --> function app 1
Subnet2 --> Function app 2

When deploying the 2nd function app with subnet i get a conflict 409 in my pipeline

"Code": "Conflict",
"Message": "Adding this VNET would exceed the App Service Plan VNET limit of 1.",
"Target": null,
"Details": [
{
"Message": "Adding this VNET would exceed the App Service Plan VNET limit of 1."
},
{
"Code": "Conflict"
},
{
"ErrorEntity": {
"ExtendedCode": "55927",
"MessageTemplate": "Adding this VNET would exceed the App Service Plan VNET limit of {0}.",
"Parameters": [
"1"
],
"Code": "Conflict",
"Message": "Adding this VNET would exceed the App Service Plan VNET limit of 1."
}
}
],
"Innererror": null
} undefined

[stefsch]

Submitted https://github.com/MicrosoftDocs/azure-docs/pull/37801 to clarify the current limit of a single subnet+vnet connection per app service plan.

Multiple apps in a single app service plan can be configured to use the exact same subnet.

However, individual apps in a single app service plan cannot be configured to connect to different subnets at this time.

[p0onage]

I just wanted to point out that this is still an issue.

Subnet on App Services VNET Options are greyed out because they need to be empty

My next step was to create a new Subnet which would be empty and I could use that. When I do this, I get the following error message

Failed to add delegation to the existing subnet: Adding this VNET would exceed the App Service Plan VNET limit of 1

My workaround was to create a new App Service Plan then moved the apps over to this app service plan and added a new VNET. I could then choose the subnet in the options because it was empty and my apps were able to communicate over the VPN as expected.

[manish-jain-1]

We are experiencing this issue. Is there an issue reported on Azure repo somewhere as this is just a docs repo? We are very disappointed with this limitation. Microsoft allowing same VNET with a new ASP but not an existing ASP. Is there a technical reason? We possibly can have hundreds of app services, so we need to pay for each service under a new premium ASP? Is there a workaround @BryanTrach-MSFT? Thank you!