I have Azure API management - premium deployed with two locations West & East.
I want to Disable the East location by running the below Azure cli
az apim update --name apimx --resource-group rg --set additionalLocations[0].disableGateway=true
It throws the following error
doesn't have permission to perform action 'join/action' on the linked scope(s) /subscription/..../subnets/APIM
Why does it try to update the subnet and what kind of update will happen?
On the How to use Azure API Management with virtual networks page it mentions
The VIP address of the API Management instance will change each time VNET is enabled or disabled. The VIP address will also change when API Management is moved from External to Internal, or vice-versa.
So it could be that each location, East and West, have their own VIP and that's what's being updated within the VNet.
The API Management resource can also make use of Subnet Delegation as per this comment in their documentation:
Enabling endpoints directly from API Management delegated subnet to these services allows them to use the Microsoft Azure backbone network providing optimal routing for service traffic.
So I would assume that if you turn it on and off it would update the VNet