[AppService] Fix #13818 Subnet in different subscription (#14344)

Author: madsd

src/Websites/Websites/ChangeLog.md

@@ -26,6 +26,7 @@
     - `Remove-AzAppServiceEnvironment`
     - `Get-AzAppServiceEnvironment`
     - `New-AzAppServiceEnvironmentInboundServices`
+* Add-AzWebAppAccessRestrictionRule: When using subnet from another subscription, -IgnoreMissingServiceEndpoint must be used. Descriptive error message added.
 
 ## Version 2.3.0
 * Added support for Importing a key vault certificate to WebApp.

src/Websites/Websites/Cmdlets/AccessRestriction/AddAzureWebAppAccessRestrictionRule.cs

@@ -187,6 +187,9 @@ public override void ExecuteCmdlet()
                         CheckDuplicateServiceEndpointRestriction(subnetResourceId, accessRestrictionList);
                         if (!IgnoreMissingServiceEndpoint)
                         {
+                            var subnetSubcriptionId = CmdletHelpers.GetSubscriptionIdFromResourceId(subnetResourceId);
+                            if (subnetSubcriptionId != DefaultContext.Subscription.Id)
+                                throw new Exception("Service endpoint cannot be validated. Subnet is in another subscription. Use -IgnoreMissingServiceEndpoint and manually verify that 'Microsoft.Web' service endpoint is enabled on the subnet.");
                             var serviceEndpointServiceName = "Microsoft.Web";
                             var serviceEndpointLocations = new List<string>() { "*" };
                             NetworkClient.EnsureSubnetServiceEndpoint(subnetResourceId, serviceEndpointServiceName, serviceEndpointLocations);

src/Websites/Websites/Utilities/CmdletHelpers.cs

@@ -368,6 +368,11 @@ internal static string GetResourceGroupFromResourceId(string resourceId)
             return new ResourceIdentifier(resourceId).ResourceGroupName;
         }
 
+        internal static string GetSubscriptionIdFromResourceId(string resourceId)
+        {
+            return new ResourceIdentifier(resourceId).Subscription;
+        }
+
         internal static void ExtractWebAppPropertiesFromWebApp(Site webapp, out string resourceGroupName, out string webAppName, out string slot)
         {
             resourceGroupName = GetResourceGroupFromResourceId(webapp.Id);