unable to delete machine from Arc using a Service Principal

Question

Hi - I'm trying to use a script to delete VMs from Arc and to do this I'm using a Service Principal. The Service Principal is able to onboard (azcmagent connect) no problem. However, when I try to offboard (azcmagent disconnect), the agent tells me the resource is already deleted. If I look in the Azure Portal however, I can see the resource is still there and is not deleted.

My Service Principal is a member of the Azure Connected Machine Onboarding role (and onboarding is fine) but it is also a member of the Azure Connected Machine Resource Administrator role which should mean, in theory, that it has rights to delete VMs too.

If I run azcmagent disconnect using browser authentication instead (for my elevated account which is a member of the Azure Connected Machine Resource Administrator role), then the VM deletes fine and I am able to almost immediately reconnect it (if I wish to).

Does anyone have any idea why I cannot delete a VM from Arc using a Service Principal which SEEMS to have the correct access level?

Answer 1

https://learn.microsoft.com/en-us/azure/azure-arc/servers/manage-agent?tabs=windows#renaming-an-azure-arc-enabled-server-resource

Use the azcmagent tool with the Disconnect parameter to disconnect the machine from Azure Arc and delete the machine resource from Azure. You can run this manually while logged on interactively, with a Microsoft identity access token, or with the service principal you used for onboarding (or with a new service principal that you create.

Answer 2

https://learn.microsoft.com/en-us/azure/azure-arc/servers/manage-agent?tabs=windows#renaming-an-azure-arc-enabled-server-resource

Use the azcmagent tool with the Disconnect parameter to disconnect the machine from Azure Arc and delete the machine resource from Azure. You can run this manually while logged on interactively, with a Microsoft identity access token, or with the service principal you used for onboarding (or with a new service principal that you create.