I am getting below error while removing DDOS Plan from a Vnet while trying from terraform , portal or powershell.

Question

Failed to update the virtual network 'vnet-name’. Error: Property id '' at path 'properties.ddosProtectionPlan.id' is invalid. Expect fully qualified resource Id that start with '/subscriptions/{subscriptionId}' or '/providers/{resourceProviderNamespace}/'.

I have tried using the Portal and still get the same error

While trying with Powershell using  given commands through cloudshell

$vNetName = "vnet-name"   $resourceGroupName = "rg-name"   $vnet = Get-AzVirtualNetwork -Name $vNetName -ResourceGroupName $resourceGroupName   $vnet.DdosProtectionPlan = $null  > $vnet.EnableDdosProtection = $false   $vnet | Set-AzVirtualNetwork

 

I get the below error –

 

Set-AzVirtualNetwork: Property id '' at path 'properties.ddosProtectionPlan.id' is invalid. Expect fully qualified resource Id that start with '/subscriptions/{subscriptionId}' or '/providers/{resourceProviderNamespace}/'. StatusCode: 400 ReasonPhrase: Bad Request ErrorCode: LinkedInvalidPropertyId ErrorMessage: Property id '' at path 'properties.ddosProtectionPlan.id' is invalid. Expect fully qualified resource Id that start with '/subscriptions/{subscriptionId}' or '/providers/{resourceProviderNamespace}/'.

 

Kindly help to fix the issue.

Answer 1

Hi @Givary-MSFT ,

Kindly check the following at your end to fix the issue -

• Since you are looking to delete a DDOS plan from a virtual network kindly verify whether associated vnets are in successful provisioning state.
• If they are in failed status do a Get Set operation using below PowerShell command

 Get-AzVirtualNetwork -Name <vnet-name> -ResourceGroupName <rg-name>| Set-AzVirtualNetwork

• Choose an alternate way to perform the same operation i.e using Powershell or terraform since you have already tried to remove association using PowerShell you can ignore this step.
• See if there is a DDOS policy “Virtual networks should be protected by Azure DDoS Protection” in force on the virtual Network
• You can check the policy enforced on either subscription or resource group level of the Virtual Network and then click the Policy tab
• 
• You can check it through below PowerShell command by replacing the Resource id with your resource id.

Get-AzPolicyState -ResourceId "/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/{resource-provider}/{resource-name}"

• Kindly delete the policy to remove the DDOS plan from the Virtual Network.
• Check if the DDOS Plan or the associated Virtual Networks are locked. Remove the lock.
• If the issue still does not resolve kindly revert back as this will need investigation by raising a support case.

---

If the below answer addressed your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.Regards

Ujjawal Tyagi