Set-AzVirtualNetworkSubnetConfig deletes existing Service Endpoints

[AviBhavsar]

#Description

After executing Set-AzureRmVirtualNetworkSubnetConfig to change the UDR association of the subnet, we lost all existing service endpoints

We had executed below script on 15th August 2019 and we have not seen any issue, whereas we executed same script on 22nd September 2019 and observed that the endpoints got deleted.

Steps to reproduce

#assume that VNET1-SUBNET1 subnet is having endpoint "Microsoft.Storage".

execute below script in sequence

$vnet = Get-AzureRmVirtualNetwork -ResourceGroupName "RG-VNET" -Name "VNET1"

$subnet = Get-AzureRmVirtualNetworkSubnetConfig -Name "VNET1-SUBNET1" -VirtualNetwork $vnet

$routeTable=Get-AzureRmRouteTable -ResourceGroupName "RG-VNET" -Name "ROUTETABLE1"

$vnet=Set-AzureRmVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name "VNET1-SUBNET1" -AddressPrefix $subnet.AddressPrefix -RouteTable $routeTable

Set-AzureRmVirtualNetwork -VirtualNetwork $vnet

After executing above script, we found that the endpoints "Microsoft.Storage" got deleted

Module versions

ModuleType Version    Name                                ExportedCommands                                                               
---------- -------    ----                                ----------------                                                               
Script     6.13.1     AzureRM                                                                                                            
Script     0.6.14     AzureRM.AnalysisServices            {Resume-AzureRmAnalysisServicesServer, Suspend-AzureRmAnalysisServicesServer...
Script     6.1.7      AzureRM.ApiManagement               {Add-AzureRmApiManagementRegion, Get-AzureRmApiManagementSsoToken, New-Azure...
Script     0.1.8      AzureRM.ApplicationInsights         {Get-AzureRmApplicationInsights, New-AzureRmApplicationInsights, Remove-Azur...
Script     6.1.1      AzureRM.Automation                  {Get-AzureRMAutomationHybridWorkerGroup, Remove-AzureRmAutomationHybridWorke...
Script     4.0.11     AzureRM.Backup                      {Backup-AzureRmBackupItem, Enable-AzureRmBackupContainerReregistration, Get-...
Script     4.1.5      AzureRM.Batch                       {Remove-AzureRmBatchAccount, Get-AzureRmBatchAccount, Get-AzureRmBatchAccoun...
Script     0.14.6     AzureRM.Billing                     {Get-AzureRmBillingInvoice, Get-AzureRmBillingPeriod, Get-AzureRmEnrollmentA...
Script     5.0.6      AzureRM.Cdn                         {Get-AzureRmCdnProfile, Get-AzureRmCdnProfileSsoUrl, New-AzureRmCdnProfile, ...
Script     0.9.12     AzureRM.CognitiveServices           {Get-AzureRmCognitiveServicesAccount, Get-AzureRmCognitiveServicesAccountKey...
Script     5.9.1      AzureRM.Compute                     {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet, New-AzureRmAvail...
Script     0.3.7      AzureRM.Consumption                 {Get-AzureRmConsumptionBudget, Get-AzureRmConsumptionMarketplace, Get-AzureR...
Script     0.2.12     AzureRM.ContainerInstance           {New-AzureRmContainerGroup, Get-AzureRmContainerGroup, Remove-AzureRmContain...
Script     1.0.10     AzureRM.ContainerRegistry           {New-AzureRmContainerRegistry, Get-AzureRmContainerRegistry, Update-AzureRmC...
Script     5.0.3      AzureRM.DataFactories               {Remove-AzureRmDataFactory, Get-AzureRmDataFactoryRun, Get-AzureRmDataFactor...
Script     0.5.11     AzureRM.DataFactoryV2               {Set-AzureRmDataFactoryV2, Update-AzureRmDataFactoryV2, Get-AzureRmDataFacto...
Script     5.1.4      AzureRM.DataLakeAnalytics           {Get-AzureRmDataLakeAnalyticsDataSource, New-AzureRmDataLakeAnalyticsCatalog...
Script     6.2.1      AzureRM.DataLakeStore               {Get-AzureRmDataLakeStoreTrustedIdProvider, Remove-AzureRmDataLakeStoreTrust...
Script     4.0.9      AzureRM.DevTestLabs                 {Get-AzureRmDtlAllowedVMSizesPolicy, Get-AzureRmDtlAutoShutdownPolicy, Get-A...
Script     5.1.0      AzureRM.Dns                         {Get-AzureRmDnsRecordSet, New-AzureRmDnsRecordConfig, Remove-AzureRmDnsRecor...
Script     0.3.7      AzureRM.EventGrid                   {New-AzureRmEventGridTopic, Get-AzureRmEventGridTopic, Set-AzureRmEventGridT...
Script     0.7.0      AzureRM.EventHub                    {New-AzureRmEventHubNamespace, Get-AzureRmEventHubNamespace, Set-AzureRmEven...
Script     4.1.8      AzureRM.HDInsight                   {Get-AzureRmHDInsightJob, New-AzureRmHDInsightSqoopJobDefinition, Wait-Azure...
Script     5.1.5      AzureRM.Insights                    {Get-AzureRmMetricDefinition, Get-AzureRmMetric, Remove-AzureRmLogProfile, G...
Script     3.1.8      AzureRM.IotHub                      {Add-AzureRmIotHubKey, Get-AzureRmIotHubEventHubConsumerGroup, Get-AzureRmIo...
Script     5.2.1      AzureRM.KeyVault                    {Add-AzureKeyVaultCertificate, Update-AzureKeyVaultCertificate, Stop-AzureKe...
Script     4.1.4      AzureRM.LogicApp                    {Get-AzureRmIntegrationAccountAgreement, Get-AzureRmIntegrationAccountCallba...
Script     0.18.5     AzureRM.MachineLearning             {Move-AzureRmMlCommitmentAssociation, Get-AzureRmMlCommitmentAssociation, Ge...
Script     0.4.8      AzureRM.MachineLearningCompute      {Get-AzureRmMlOpCluster, Get-AzureRmMlOpClusterKey, Test-AzureRmMlOpClusterS...
Script     0.2.7      AzureRM.MarketplaceOrdering         {Get-AzureRmMarketplaceTerms, Set-AzureRmMarketplaceTerms}                     
Script     0.10.4     AzureRM.Media                       {Sync-AzureRmMediaServiceStorageKeys, Set-AzureRmMediaServiceKey, Get-AzureR...
Script     6.11.1     AzureRM.Network                     {Add-AzureRmApplicationGatewayAuthenticationCertificate, Get-AzureRmApplicat...
Script     5.0.3      AzureRM.NotificationHubs            {Get-AzureRmNotificationHub, Get-AzureRmNotificationHubAuthorizationRules, G...
Script     5.0.6      AzureRM.OperationalInsights         {New-AzureRmOperationalInsightsAzureActivityLogDataSource, New-AzureRmOperat...
Script     1.1.0      AzureRM.PolicyInsights              {Get-AzureRmPolicyEvent, Get-AzureRmPolicyState, Get-AzureRmPolicyStateSumma...
Script     4.1.10     AzureRM.PowerBIEmbedded             {Remove-AzureRmPowerBIWorkspaceCollection, Get-AzureRmPowerBIWorkspaceCollec...
Script     5.8.3      AzureRM.profile                     {Disable-AzureRmDataCollection, Disable-AzureRmContextAutosave, Enable-Azure...
Script     5.8.2      AzureRM.profile                     {Disable-AzureRmDataCollection, Disable-AzureRmContextAutosave, Enable-Azure...
Script     4.1.9      AzureRM.RecoveryServices            {Get-AzureRmRecoveryServicesBackupProperty, Get-AzureRmRecoveryServicesVault...
Script     4.5.2      AzureRM.RecoveryServices.Backup     {Backup-AzureRmRecoveryServicesBackupItem, Get-AzureRmRecoveryServicesBackup...
Script     0.2.12     AzureRM.RecoveryServices.SiteRec... {Edit-AzureRmRecoveryServicesAsrRecoveryPlan, Get-AzureRmRecoveryServicesAsr...
Script     5.1.0      AzureRM.RedisCache                  {Remove-AzureRmRedisCachePatchSchedule, New-AzureRmRedisCacheScheduleEntry, ...
Script     0.3.12     AzureRM.Relay                       {New-AzureRmRelayNamespace, Get-AzureRmRelayNamespace, Set-AzureRmRelayNames...
Script     6.7.3      AzureRM.Resources                   {Get-AzureRmProviderOperation, Remove-AzureRmRoleAssignment, Get-AzureRmRole...
Script     0.16.10    AzureRM.Scheduler                   {Disable-AzureRmSchedulerJobCollection, Enable-AzureRmSchedulerJobCollection...
Script     0.6.13     AzureRM.ServiceBus                  {New-AzureRmServiceBusNamespace, Get-AzureRmServiceBusNamespace, Set-AzureRm...
Script     0.3.15     AzureRM.ServiceFabric               {Add-AzureRmServiceFabricApplicationCertificate, Add-AzureRmServiceFabricCli...
Script     1.0.0      AzureRM.SignalR                     {New-AzureRmSignalR, Get-AzureRmSignalR, Get-AzureRmSignalRKey, New-AzureRmS...
Script     4.12.1     AzureRM.Sql                         {Get-AzureRmSqlDatabaseTransparentDataEncryption, Get-AzureRmSqlDatabaseTran...
Script     5.2.0      AzureRM.Storage                     {Get-AzureRmStorageAccount, Get-AzureRmStorageAccountKey, New-AzureRmStorage...
Script     4.0.10     AzureRM.StreamAnalytics             {Get-AzureRmStreamAnalyticsFunction, Get-AzureRmStreamAnalyticsDefaultFuncti...
Script     4.0.5      AzureRM.Tags                        {Remove-AzureRmTag, Get-AzureRmTag, New-AzureRmTag}                            
Script     4.1.3      AzureRM.TrafficManager              {Add-AzureRmTrafficManagerCustomHeaderToEndpoint, Remove-AzureRmTrafficManag...
Script     4.0.5      AzureRM.UsageAggregates             Get-UsageAggregates                                                            
Script     5.2.0      AzureRM.Websites                    {Get-AzureRmAppServicePlan, Set-AzureRmAppServicePlan, New-AzureRmAppService...

Debug output

As per PowerShell session log, we see endpoints related elements in json file , please find below :
"ServiceEndpoints": [
{
"ProvisioningState": "Succeeded",
"Service": "Microsoft.Storage",
"Locations": [
"centralus",
"eastus2"
]

Error output

[anton-evseev]

If you don't pass ServiceEndpoints in Set-AzureRmVirtualNetworkSubnetConfig, the property is set to null. This is common behavior among Set cmdlets.

https://github.com/Azure/azure-powershell/blob/master/src/Network/Network/VirtualNetwork/Subnet/SetAzureVirtualNetworkSubnetConfigCommand.cs#L90

Judging by the blame the code for ServiceEndpoints didn't change for the last 2 years, it seems strange you didn't have this problem before.

@Am018, could you confirm?

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @KarenHammons @sfiguemsft

[sfiguemsft]

@sumeetmittal can you look into this please?

[sumeetmittal]

@avijitgupta - please take a look.

This is by design. This is how the NRP works. When doing a PUT, if ServiceEndpoints configs are missing, a PUT operation on a subnet will treat it as user's intent to set Service endpoints config to null.

[allegradomel]

Hi @AviBhavsar, thanks for your patience. Working on updating this soon.

[allegradomel]

Since this is done by design and there don't seem to be further questions, closing