Search Service cannot be removed with azd down command

[doruit]

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

After azd up and everything successully deployed, run the azd down command. The Search Service will not be deleted because there are Shared private access sub-resources that needs to be removed first.

Any log messages given by the failure

Using Azure Resource Explorer:
{
"message": "Unable to delete Search Service: 'REDACTED'. UnableToVerifyLocks: Cannot verify management locks for resource: 'REDACTED'. Please try again later. Message: 'The access token is from the wrong issuer 'REDACTED'. It must match the tenant 'REDACTED' associated with this subscription. Please use the authority (URL) 'REDACTED' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.\r\nStatus: 401 (Unauthorized)\r\nErrorCode: InvalidAuthenticationTokenTenant\r\n\r\nContent:\r\n{"error":{"code":"InvalidAuthenticationTokenTenant","message":"The access token is from the wrong issuer 'REDACTED'. It must match the tenant 'REDACTED' associated with this subscription. Please use the authority (URL) 'REDACTED' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later."}}\r\n\r\nHeaders:\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nWWW-Authenticate: Bearer authorization_uri="REDACTED", error="invalid_token", error_description="The access token is from the wrong issuer. It must match the tenant associated with this subscription. Please use correct authority to get the token."\r\nx-ms-failure-cause: REDACTED\r\nx-ms-request-id: REDACTED\r\nx-ms-correlation-request-id: REDACTED\r\nx-ms-routing-request-id: REDACTED\r\nStrict-Transport-Security: REDACTED\r\nX-Content-Type-Options: REDACTED\r\nX-Cache: REDACTED\r\nX-MSEdge-Ref: REDACTED\r\nDate: REDACTED\r\nContent-Length: REDACTED\r\nContent-Type: application/json; charset=utf-8\r\nExpires: -1\r\n' RequestId: REDACTED",
}
Using portal:
"Failed to delete Search Service"

Expected/desired behavior

azd down should be able to delete a Search Service resource, including the sub-resources.

OS and Version?

macOS, however the OS of my laptop seem not relevant to this issue

azd version?

run azd version and copy paste here.
azd version 1.10.1 (commit 31409a33266fb4a5fdbb644bc83988e725d6c7c9)

Workaround

Manually delete the Shared private access sub-resources in de Search Service first before running azd down.

[MarcoABCardoso]

Hello @doruit ! Thank you for reporting.

The issue seems to be related to your currently logged in az CLI user - you could be logged in with different tenants on az and azd CLIs.
You can verify if that is the case by running the following:

azd env get-values
az account show

Each command will output a tenant ID, and if they don't match, there could be issues during deployment.

This will be added to the troubleshooting guide as it's a common issue.
Please let us know if you have further questions or comments!