diff --git a/azurerm/resource_arm_subnet_network_security_group_association.go b/azurerm/resource_arm_subnet_network_security_group_association.go
index c093b0d2882b..3aeb197873d5 100644
--- a/azurerm/resource_arm_subnet_network_security_group_association.go
+++ b/azurerm/resource_arm_subnet_network_security_group_association.go
@@ -67,12 +67,12 @@ func resourceArmSubnetNetworkSecurityGroupAssociationCreate(d *schema.ResourceDa
 	virtualNetworkName := parsedSubnetId.Path["virtualNetworks"]
 	resourceGroup := parsedSubnetId.ResourceGroup
 
-	locks.ByName(virtualNetworkName, virtualNetworkResourceName)
-	defer locks.UnlockByName(virtualNetworkName, virtualNetworkResourceName)
-
 	locks.ByName(subnetName, subnetResourceName)
 	defer locks.UnlockByName(subnetName, subnetResourceName)
 
+	locks.ByName(virtualNetworkName, virtualNetworkResourceName)
+	defer locks.UnlockByName(virtualNetworkName, virtualNetworkResourceName)
+
 	subnet, err := client.Get(ctx, resourceGroup, virtualNetworkName, subnetName, "")
 	if err != nil {
 		if utils.ResponseWasNotFound(subnet.Response) {