'Subnet in use' error in `az network vnet subnet update` command with `--nat-gateway` parameter

When trying to associate a NAT gateway with one of the subnets in my VNET, I consistently get the following error message:

```
'BadRequestError: Subnet [subnetname] is in use and cannot be updated.`
```

When I try to do the exact same operation in the Azure Portal - within a couple of seconds, it works fine:


I'm aware that I'm associating the subnet with the NAT gateway in my command, whereas I'm associating the NAT gateway with the subnet in the portal. My initial idea was to use [az network nat gateway update](https://docs.microsoft.com/en-us/cli/azure/network/nat/gateway?view=azure-cli-latest#az_network_nat_gateway_update) but I can't find a way to associate the NAT GW with the subnet. And so I went with `subnet update`.

Am I using the wrong command or could there be an issue with the command?

Script to help reproduce [here](https://github.com/jochenvw/func-static-public-ip-outbound/blob/main/infra/deploy-nat-gw.azcli)
Full `--debug` of the command here:
```
Command arguments: ['network', 'vnet', 'subnet', 'update', '-n', 'TransformationAppSubnet', '--vnet-name', 'filetrnsfrm-vnet-dev', '--resource-group', 'prefix-filetrnsfrm-dev', '--nat-gateway', 'filetrnsfrm-natgw-dev', '--address-prefixes', '0.0.0.0/0', '--debug']
Event: Cli.PreExecute []
Event: CommandParser.OnGlobalArgumentsCreate [, , ]
Event: CommandInvoker.OnPreCommandTableCreate []
Modules found from index for 'network': ['azure.cli.command_modules.natgateway', 'azure.cli.command_modules.network', 'azure.cli.command_modules.privatedns', 'azext_firewall']
Loading command modules:
Name Load Time Groups Commands
natgateway 0.005 3 6
network 0.037 120 550
privatedns 0.008 14 66
Total (3) 0.050 137 622
These extensions are not installed and will be skipped: ['azext_ai_examples']
Loading extensions:
Name Load Time Groups Commands Directory
azure-firewall 0.010 15 53 C:\Users\[me]\.azure\cliextensions\azure-firewall
Total (1) 0.010 15 53
Loaded 149 groups, 675 commands.
Found a match in the command table.
Raw command : network vnet subnet update
Command table: network vnet subnet update
Event: CommandInvoker.OnPreCommandTableTruncate []
az_command_data_logger : command args: network vnet subnet update -n {} --vnet-name {} --resource-group {} --nat-gateway {} --address-prefixes {} --debug
metadata file logging enabled - writing logs to 'C:\Users\[me]\.azure\commands'.
Event: CommandInvoker.OnPreArgumentLoad [.add_subscription_parameter at 0x03E1F618>, .register_query_examples at 0x03E1FD68>]
Event: CommandInvoker.OnPostArgumentLoad []
Event: CommandInvoker.OnPostCommandTableCreate [.add_ids_arguments at 0x03E1FDB0>, .add_cache_arguments at 0x03E1FE40>]
Event: CommandInvoker.OnCommandTableLoaded []
Event: CommandInvoker.OnPreParseArgs []
Event: CommandInvoker.OnPostParseArgs [, , .handle_example_parameter at 0x03E1F780>, .parse_ids_arguments at 0x03E1FDF8>]
Getting management service client client_type=NetworkManagementClient
msrest.universal_http.requests : Configuring retry: max_retries=4, backoff_factor=0.8, max_backoff=90
attempting to read file C:\Users\[me]\.azure\accessTokens.json as utf-8-sig
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - Authority:Performing instance discovery: ...
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - Authority:Performing static instance discovery
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - Authority:Authority validated via static instance discovery
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - TokenRequest:Getting token from cache with refresh if necessary.
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - CacheDriver:finding with query keys: {'_clientId': '...', 'userId': '...'}
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - CacheDriver:Looking for potential cache entries: {'_clientId': '...', 'userId': '...'}
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - CacheDriver:Found 6 potential entries.
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - CacheDriver:Resource specific token found.
adal-python : 6f0fba4a-feb6-4253-b50d-7ecfa3e8c1e8 - CacheDriver:Returning token from cache lookup, AccessTokenId: b'P3KuK4poOklBsqTvq5Vg3jOaSlBQZX2buPfk7dUYTww=', RefreshTokenId: b'JqCerIi+i0bJC9KosJ98GolPD26bD09KkE1O0xry4cQ='
msrest.http_logger : Request URL: 'https://management.azure.com/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet?api-version=2020-06-01'
msrest.http_logger : Request method: 'GET'
msrest.http_logger : Request headers:
msrest.http_logger : 'Accept': 'application/json'
msrest.http_logger : 'accept-language': 'en-US'
msrest.http_logger : 'User-Agent': 'python/3.6.8 (Windows-10-10.0.20175-SP0) msrest/0.6.18 msrest_azure/0.6.3 azure-mgmt-network/12.0.0 Azure-SDK-For-Python AZURECLI/2.14.2'
msrest.http_logger : Request body:
msrest.http_logger : None
msrest.universal_http : Configuring redirects: allow=True, max=30
msrest.universal_http : Configuring request: timeout=100, verify=True, cert=None
msrest.universal_http : Configuring proxies: ''
msrest.universal_http : Evaluate proxies against ENV settings: True
urllib3.connectionpool : Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool : https://management.azure.com:443 "GET /subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet?api-version=2020-06-01 HTTP/1.1" 200 None
msrest.http_logger : Response status: 200
msrest.http_logger : Response headers:
msrest.http_logger : 'Cache-Control': 'no-cache'
msrest.http_logger : 'Pragma': 'no-cache'
msrest.http_logger : 'Transfer-Encoding': 'chunked'
msrest.http_logger : 'Content-Type': 'application/json; charset=utf-8'
msrest.http_logger : 'Content-Encoding': 'gzip'
msrest.http_logger : 'Expires': '-1'
msrest.http_logger : 'ETag': 'W/"67500a4e-68db-4802-92ee-4c10b243eca8"'
msrest.http_logger : 'Vary': 'Accept-Encoding'
msrest.http_logger : 'x-ms-request-id': 'ce3ccdb2-c3fa-4b21-95a8-ea346bbb5ca9'
msrest.http_logger : 'x-ms-correlation-request-id': 'd606dbd6-13a0-4dad-94ea-b04e03b28684'
msrest.http_logger : 'x-ms-arm-service-request-id': '87401523-6729-4764-a8b3-1b8f0a5860d5'
msrest.http_logger : 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
msrest.http_logger : 'Server': 'Microsoft-HTTPAPI/2.0, Microsoft-HTTPAPI/2.0'
msrest.http_logger : 'x-ms-ratelimit-remaining-subscription-reads': '11999'
msrest.http_logger : 'x-ms-routing-request-id': 'WESTEUROPE:20201112T184648Z:d606dbd6-13a0-4dad-94ea-b04e03b28684'
msrest.http_logger : 'X-Content-Type-Options': 'nosniff'
msrest.http_logger : 'Date': 'Thu, 12 Nov 2020 18:46:48 GMT'
msrest.http_logger : Response content:
msrest.http_logger : {
"name": "TransformationAppSubnet",
"id": "/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet",
"etag": "W/\"67500a4e-68db-4802-92ee-4c10b243eca8\"",
"properties": {
"provisioningState": "Succeeded",
"addressPrefix": "10.0.1.0/24",
"serviceAssociationLinks": [
{
"name": "AppServiceLink",
"id": "/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet/serviceAssociationLinks/AppServiceLink",
"etag": "W/\"67500a4e-68db-4802-92ee-4c10b243eca8\"",
"type": "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks",
"properties": {
"provisioningState": "Succeeded",
"linkedResourceType": "Microsoft.Web/serverfarms",
"link": "/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Web/serverfarms/filetrnsfrm-asp-dev",
"allowDelete": false,
"locations": []
}
}
],
"delegations": [
{
"name": "0",
"id": "/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet/delegations/0",
"etag": "W/\"67500a4e-68db-4802-92ee-4c10b243eca8\"",
"properties": {
"provisioningState": "Succeeded",
"serviceName": "Microsoft.Web/serverFarms",
"actions": [
"Microsoft.Network/virtualNetworks/subnets/action"
]
},
"type": "Microsoft.Network/virtualNetworks/subnets/delegations"
}
],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
},
"type": "Microsoft.Network/virtualNetworks/subnets"
}
Getting management service client client_type=NetworkManagementClient
msrest.universal_http.requests : Configuring retry: max_retries=4, backoff_factor=0.8, max_backoff=90
Getting management service client client_type=NetworkManagementClient
msrest.universal_http.requests : Configuring retry: max_retries=4, backoff_factor=0.8, max_backoff=90
Getting management service client client_type=NetworkManagementClient
msrest.universal_http.requests : Configuring retry: max_retries=4, backoff_factor=0.8, max_backoff=90
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - Authority:Performing instance discovery: ...
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - Authority:Performing static instance discovery
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - Authority:Authority validated via static instance discovery
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - TokenRequest:Getting token from cache with refresh if necessary.
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - CacheDriver:finding with query keys: {'_clientId': '...', 'userId': '...'}
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - CacheDriver:Looking for potential cache entries: {'_clientId': '...', 'userId': '...'}
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - CacheDriver:Found 6 potential entries.
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - CacheDriver:Resource specific token found.
adal-python : ceb3da9e-b89c-4904-a8b2-f5eed585bf5a - CacheDriver:Returning token from cache lookup, AccessTokenId: b'P3KuK4poOklBsqTvq5Vg3jOaSlBQZX2buPfk7dUYTww=', RefreshTokenId: b'JqCerIi+i0bJC9KosJ98GolPD26bD09KkE1O0xry4cQ='
msrest.http_logger : Request URL: 'https://management.azure.com/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet?api-version=2020-06-01'
msrest.http_logger : Request method: 'PUT'
msrest.http_logger : Request headers:
msrest.http_logger : 'Accept': 'application/json'
msrest.http_logger : 'Content-Type': 'application/json; charset=utf-8'
msrest.http_logger : 'accept-language': 'en-US'
msrest.http_logger : 'Content-Length': '870'
msrest.http_logger : 'User-Agent': 'python/3.6.8 (Windows-10-10.0.20175-SP0) msrest/0.6.18 msrest_azure/0.6.3 azure-mgmt-network/12.0.0 Azure-SDK-For-Python AZURECLI/2.14.2'
msrest.http_logger : Request body:
msrest.http_logger : {"id": "/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet", "properties": {"addressPrefix": "0.0.0.0/0", "natGateway": {"id": "/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/natGateways/filetrnsfrm-natgw-dev"}, "delegations": [{"id": "/subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet/delegations/0", "properties": {"serviceName": "Microsoft.Web/serverFarms"}, "name": "0"}], "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled"}, "name": "TransformationAppSubnet"}
msrest.universal_http : Configuring redirects: allow=True, max=30
msrest.universal_http : Configuring request: timeout=100, verify=True, cert=None
msrest.universal_http : Configuring proxies: ''
msrest.universal_http : Evaluate proxies against ENV settings: True
urllib3.connectionpool : Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool : https://management.azure.com:443 "PUT /subscriptions/[GUID]/resourceGroups/prefix-filetrnsfrm-dev/providers/Microsoft.Network/virtualNetworks/filetrnsfrm-vnet-dev/subnets/TransformationAppSubnet?api-version=2020-06-01 HTTP/1.1" 400 168
msrest.http_logger : Response status: 400
msrest.http_logger : Response headers:
msrest.http_logger : 'Cache-Control': 'no-cache'
msrest.http_logger : 'Pragma': 'no-cache'
msrest.http_logger : 'Content-Length': '168'
msrest.http_logger : 'Content-Type': 'application/json; charset=utf-8'
msrest.http_logger : 'Expires': '-1'
msrest.http_logger : 'x-ms-request-id': '1869a2cb-c343-499d-af2e-466789ecc941'
msrest.http_logger : 'x-ms-correlation-request-id': 'b4c6958b-b4e1-4839-88d8-a0b52158c5ee'
msrest.http_logger : 'x-ms-arm-service-request-id': 'f1f6d7bc-a6ff-42d0-a9a5-c7bf298fa920'
msrest.http_logger : 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
msrest.http_logger : 'Server': 'Microsoft-HTTPAPI/2.0, Microsoft-HTTPAPI/2.0'
msrest.http_logger : 'x-ms-ratelimit-remaining-subscription-writes': '1199'
msrest.http_logger : 'x-ms-routing-request-id': 'WESTEUROPE:20201112T184649Z:b4c6958b-b4e1-4839-88d8-a0b52158c5ee'
msrest.http_logger : 'X-Content-Type-Options': 'nosniff'
msrest.http_logger : 'Date': 'Thu, 12 Nov 2020 18:46:48 GMT'
msrest.http_logger : Response content:
msrest.http_logger : {
"error": {
"code": "InUseSubnetCannotBeUpdated",
"message": "Subnet TransformationAppSubnet is in use and cannot be updated.",
"details": []
}
}
msrest.exceptions : Subnet TransformationAppSubnet is in use and cannot be updated.
azure.cli.core.util.handle_exception is called with an exception:
Traceback (most recent call last):
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-o2uit6zy\knack\cli.py", line 215, in invoke
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mdyrq85s\azure\cli\core\commands\__init__.py", line 654, in execute
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mdyrq85s\azure\cli\core\commands\__init__.py", line 718, in _run_jobs_serially
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mdyrq85s\azure\cli\core\commands\__init__.py", line 711, in _run_job
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-3fdrh26k\six.py", line 703, in reraise
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mdyrq85s\azure\cli\core\commands\__init__.py", line 688, in _run_job
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mdyrq85s\azure\cli\core\commands\__init__.py", line 325, in __call__
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mdyrq85s\azure\cli\core\commands\arm.py", line 569, in handler
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mdyrq85s\azure\cli\core\commands\__init__.py", line 444, in cached_put
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-mdyrq85s\azure\cli\core\commands\__init__.py", line 438, in _put_operation
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-l9axtgzn\azure\mgmt\network\v2020_06_01\operations\_subnets_operations.py", line 281, in create_or_update
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-l9axtgzn\azure\mgmt\network\v2020_06_01\operations\_subnets_operations.py", line 233, in _create_or_update_initial
msrestazure.azure_exceptions.CloudError: Azure Error: InUseSubnetCannotBeUpdated
Message: Subnet TransformationAppSubnet is in use and cannot be updated.

cli.azure.cli.core.azclierror : BadRequestError: Subnet TransformationAppSubnet is in use and cannot be updated.
BadRequestError: Subnet TransformationAppSubnet is in use and cannot be updated.
Event: Cli.PostExecute []
az_command_data_logger : exit code: 1
Command ran in 1.802 seconds (init: 0.207, invoke: 1.595)
telemetry.save : Save telemetry record of length 3034 in cache
telemetry.check : Negative: The C:\Users\[me]\.azure\telemetry.txt was modified at 2020-11-12 19:45:01.088539, which in less than 600.000000 s
```