diff --git a/azurerm/internal/services/network/subnet_network_security_group_association_resource.go b/azurerm/internal/services/network/subnet_network_security_group_association_resource.go
index 337e54703b3d..da8def427515 100644
--- a/azurerm/internal/services/network/subnet_network_security_group_association_resource.go
+++ b/azurerm/internal/services/network/subnet_network_security_group_association_resource.go
@@ -76,12 +76,12 @@ func resourceSubnetNetworkSecurityGroupAssociationCreate(d *pluginsdk.ResourceDa
 	virtualNetworkName := parsedSubnetId.Path["virtualNetworks"]
 	resourceGroup := parsedSubnetId.ResourceGroup
 
-	locks.ByName(subnetName, SubnetResourceName)
-	defer locks.UnlockByName(subnetName, SubnetResourceName)
-
 	locks.ByName(virtualNetworkName, VirtualNetworkResourceName)
 	defer locks.UnlockByName(virtualNetworkName, VirtualNetworkResourceName)
 
+	locks.ByName(subnetName, SubnetResourceName)
+	defer locks.UnlockByName(subnetName, SubnetResourceName)
+
 	subnet, err := client.Get(ctx, resourceGroup, virtualNetworkName, subnetName, "")
 	if err != nil {
 		if utils.ResponseWasNotFound(subnet.Response) {