unable to add custom domain for standard V2 APIM deployed in UK west

Hello Shib,

Thank you for reaching out on Microsoft Q&A!

To answer your follow-up question first: There is no mandatory Azure-enforced wait time required between deleting a custom domain from one API Management (APIM) instance and adding it to another.

However, the "silent deletion" you are experiencing occurs because Azure API Management performs an asynchronous validation after you save the custom domain. If any validation step fails in the background, APIM silently rolls back the operation, removing the hostname to prevent the gateway from entering an unstable state.

Based on official Microsoft documentation, here are the most common reasons this background validation fails during a migration to a Standard V2 instance, and how to resolve them:

1. Stale DNS Records and Propagation (Most Common): Even though there is no wait time on the Azure platform, you must wait for your DNS changes to propagate. If APIM checks the domain and the CNAME or TXT record still resolves to your old UK South Premium APIM, the validation will fail and the domain will be dropped.

• If using a Free Managed Certificate: You must update the TXT record for the new V2 instance. As noted in the official documentation:

  "When enabling the free, managed certificate for API Management, also configure a TXT record in your DNS zone to establish your ownership of the domain name. The name of the record is your custom domain name prefixed by apimuid... The value is a domain ownership identifier provided by your API Management instance."

• Resolution: Ensure the CNAME points to the new UK West V2 default endpoint and the apimuid TXT record has been updated. Allow time for DNS propagation.

2. Key Vault Permissions for the New V2 Instance: If you are using a custom certificate stored in Azure Key Vault, your new UK West Standard V2 APIM must have explicit permissions to read it. Because this is a new APIM instance, it has a completely different Managed Identity than your old UK South APIM.

• As per the documentation:

  "Depending on the permission model, configure either a key vault access policy or Azure RBAC access for an API Management managed identity."

• Resolution: If the new V2 identity lacks Get and List permissions for Secrets/Certificates in the Key Vault, the deployment will silently fail. Update your Key Vault Access Policies or RBAC role assignments to include the new UK West APIM identity.

3. Finding the Exact Error: Because the APIM portal silently drops the domain, you can find the actual error causing the rollback by looking at the Deployment logs:

1. Navigate to the Resource Group containing your new UK West V2 APIM.
2. Click on Deployments under the Settings menu on the left.
3. Find the recent failed deployment (timestamped right after the custom domain disappeared).
4. Look at the Operation details, which will reveal the specific error (e.g., KeyVaultAccessDenied, CertificateNotFound, or Hostname already in use).

Once DNS has fully propagated to the new instance and Key Vault permissions are confirmed, the asynchronous validation will succeed and the domain will persist.

Note: This response is drafted with the help of AI systems.

Hi,

I already have a custom domain added for UK South Premium APIM.

Because Standard V2 APIM only get supported in UK west, i have created a new APIM in UK west region and trying to migrate everything from UK south to UK west APIM.

During migration, i am also trying to delete and add custom domain, but:

• while deleting custom domain from UK south APIM, it was successfully deleted
• while adding custom domain into UK west region, its getting added successfully but in a while getting deleted silently without showing any error.

Need urgent support in addressing this issue.

Regards,

Shib

I exactly followed the same process but unable to add. How much time i need to wait between deletion of a custom domain in UK South Premium APIM and adding it back to UK west Standard V2 APIM?