[bug] Doing deployment and get 'connections in use' for Capability Hosts

[Jan de Vries (Jandev)]

As part of our CI/CD pipelines some Bicep templates get deployed. Most of the time it's a noop action, like is the case now.

As of yesterday, when we wanted to do a new deployment, we start receiving this error when deploying:

{"code":"UserError","message":"Connection 'cosmos-sp-customer-dev-cosmos' is in use by the workspace capability host and cannot be modified or deleted through the connections API. Update the owning capabilitySettings value instead.","details":[]},

{"code":"UserError","message":"Connection 'search-sp-customer-dev-searc' is in use by the workspace capability host and cannot be modified or deleted through the connections API. Update the owning capabilitySettings value instead.","details":[]},

{"code":"UserError","message":"Connection 'storage-spcustpricingdevaist' is in use by the workspace capability host and cannot be modified or deleted through the connections API. Update the owning capabilitySettings value instead.","details":[]},

We have a MS Foundry resource with Capability Hosts to AI Search, Storage Account & Cosmos DB.
This has been working fine for the past couple of weeks/months. However, we're now experiencing this issue.

It looks like 'something' has changed or is blocking us from deploying on the platform.

---

For reference (this hasn't changed in 4 months).

// ---- Module for the connections ----

// Reference the existing AI Services account
resource aiServicesAccount 'Microsoft.CognitiveServices/accounts@2025-09-01' existing = {
  name: aiServicesAccountName
}

// Connection names for capability host (must match pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]{2,32}$)
var cosmosDbConnectionName = 'cosmos-${take(cosmosDbAccountName, 26)}'
var storageConnectionName = 'storage-${take(storageAccountName, 24)}'
var aiSearchConnectionName = 'search-${take(aiSearchName, 25)}'
var appInsightsConnectionName = 'appinsights-${take(applicationInsightsName, 20)}'

// Create Cosmos DB connection at ACCOUNT level for thread storage
// isSharedToAll: true makes it available to all projects
resource cosmosDbConnection 'Microsoft.CognitiveServices/accounts/connections@2025-09-01' = {
  name: cosmosDbConnectionName
  parent: aiServicesAccount
  properties: {
    category: 'CosmosDB'
    target: 'https://${cosmosDbAccountName}.documents.azure.com:443/'
    authType: 'AAD'
    isSharedToAll: true
    metadata: {
      ApiType: 'Azure'
      ResourceId: '/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup().name}/providers/Microsoft.DocumentDB/databaseAccounts/${cosmosDbAccountName}'
      location: location
    }
  }
}

// Create Storage connection at ACCOUNT level for file storage
resource storageConnection 'Microsoft.CognitiveServices/accounts/connections@2025-09-01' = {
  name: storageConnectionName
  parent: aiServicesAccount
  properties: {
    category: 'AzureStorageAccount'
    target: 'https://${storageAccountName}.blob.${az.environment().suffixes.storage}'
    authType: 'AAD'
    isSharedToAll: true
    metadata: {
      ApiType: 'Azure'
      ResourceId: '/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup().name}/providers/Microsoft.Storage/storageAccounts/${storageAccountName}'
    }
  }
}

// Create AI Search connection at ACCOUNT level for vector storage
resource aiSearchConnection 'Microsoft.CognitiveServices/accounts/connections@2025-09-01' = {
  name: aiSearchConnectionName
  parent: aiServicesAccount
  properties: {
    category: 'CognitiveSearch'
    target: 'https://${aiSearchName}.search.windows.net'
    authType: 'AAD'
    isSharedToAll: true
    metadata: {
      ApiType: 'Azure'
      ResourceId: '/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup().name}/providers/Microsoft.Search/searchServices/${aiSearchName}'
      location: location
    }
  }
}

// Create Application Insights connection at ACCOUNT level for agent tracing (Foundry Observability)
// Links the existing App Insights resource to Foundry so the "Traces" tab in the portal lights up.
// See: https://learn.microsoft.com/en-us/azure/foundry/observability/how-to/trace-agent-setup
resource appInsightsConnection 'Microsoft.CognitiveServices/accounts/connections@2025-09-01' = {
  name: appInsightsConnectionName
  parent: aiServicesAccount
  properties: {
    category: 'AppInsights'
    target: applicationInsightsResourceId
    authType: 'ApiKey'
    credentials: {
      key: applicationInsightsConnectionString
    }
    isSharedToAll: true
    metadata: {
      ApiType: 'Azure'
      ResourceId: applicationInsightsResourceId
    }
  }
}

// ---- Module for the Capability Hosts -----
// Account-level capability host for Agents
resource accountCapabilityHost 'Microsoft.CognitiveServices/accounts/capabilityHosts@2025-09-01' = {
  name: 'account-capability-host'
  parent: aiServicesAccount
  properties: {
    capabilityHostKind: 'Agents'
    vectorStoreConnections: [aiSearchConnectionName]
    storageConnections: [storageConnectionName]
    threadStorageConnections: [cosmosDbConnectionName]
    customerSubnet: !empty(customerSubnetId) ? customerSubnetId : null
  }
}

// Project-level capability host - references same connections as account level
resource projectCapabilityHost 'Microsoft.CognitiveServices/accounts/projects/capabilityHosts@2025-09-01' = {
  name: 'project-capability-host'
  parent: project
  properties: {
    vectorStoreConnections: [aiSearchConnectionName]
    storageConnections: [storageConnectionName]
    threadStorageConnections: [cosmosDbConnectionName]
  }
  dependsOn: [
    accountCapabilityHost
  ]
}

---

Additional details

Region: Sweden Central

[Nick Brady (nicholasdbrady)]

Thanks for the detailed report and Bicep sample. If possible, don't delete or recreate those just resources yet. I'm checking with my team whether this is a recent service rollout and they may appreciate the failed deployment timestamp and ARM correlation/request IDs, request you to submit a support ticket. Stay tuned.

[Jeremy Kramer (JKrame)]

Hi Jan de Vries (@Jandev), a temporary mitigation to unblock your pipeline would be to apply @onlyIfNotExists tags to your BYO connections in the bicep. A fix loosening the restriction should be available to all regions within 2 weeks.

[Jan de Vries (Jandev)]

Thanks for the suggestion.

For now, I've added a flag to our deployments to skip the connections.

By default it's off, only when I turn it on it skips the connections and the deployment succeeds.

Thanks for the fix! Looking forward to remove this flag.

[Jan de Vries (Jandev)]

Got back from vacation and did a couple of deployments.
I didn't need to toggle the skip-flag anymore, so I think the change has fixed my issue at least. Thanks!