Azure Remove completely storage account with locked policy

Question

Azure Remove completely storage account with locked policy

Ganczarczyk, Marek 20

I want to remove completely whole storage account currently it is not possible cause it isn't empty. This operation is not permitted as the blob is immutable due to a policy. "Blob Immutability Policy: deleting UntilDate on locked policy is not allowed" I need to remove this whole storage account or blobs with workaround.

$BlobProperties.ImmutabilityPolicy

ExpiresOn PolicyMode

3/8/2034 12:00:00 AM +00:00 Locked

Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-18T18:44:16.3+00:00
Hi Ganczarczyk, Marek,

There are no legal holds applied to the blobs. Legal holds can prevent deletion even if the immutability policy has expired.If possible, try to modify or remove the immutability policy. You can use Azure CLI or Azure PowerShell for this. For example, using Azure CLI:

az storage blob immutability-policy delete --account-name <StorageAccountName> --container-name <ContainerName> --name <BlobName>

Once the policy is removed or modified, delete the blobs and containers. You can use Azure Storage Explorer or Azure PowerShell to do this. After all blobs and containers are deleted, you should be able to delete the storage account.

If the policy is locked and cannot be modified or removed, you may need to wait until the policy expires. Unfortunately, if the policy is set to expire in 2034, you might not be able to delete the storage account until then.

For more information:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

https://learn.microsoft.com/en-us/rest/api/storagerp/blob-containers/delete-immutability-policy?view=rest-Required fields are marked with asterisk/starDisplay text Address SaveRemovestoragerp-2023-05-01&tabs=HTTP

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Ganczarczyk, Marek 20 Reputation points

2025-02-19T08:38:36.4733333+00:00

What if I don't to pay for that? Orphan whole subscription or tenant? That is the case. 3rd party software set this locked flag and it is cost:1500$. so the open question is: under Azure am I administrator or not? at on-premise I can remove whole array, destroy disks. Azure seems to be money machine for MS
Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-20T19:08:32.2833333+00:00

Hi Ganczarczyk, Marek,

I understand immutability policies are designed to ensure data integrity and compliance, which can sometimes make deletion challenging. Few points to consider

As an Azure administrator, you have significant control over resources, but certain policies, like immutability, are designed to be tamper-proof to meet compliance requirements

This is different from on-premises environments where you might have more direct control over hardware.

If the immutability policy was set by third-party software and is causing unexpected costs, you might want to explore Azure's cost management tools to better understand and manage your expenses.

For more information:
https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you
Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-21T16:43:31.0866667+00:00

Hi Ganczarczyk, Marek,

Just checking in to see if the response helped. If you have any questions, let me know in the "comments" and I would be happy to help you.
Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-24T16:14:38.71+00:00

Hi Ganczarczyk, Marek,

Just checking in to see if the response helped. If you have any questions, let me know in the "comments" and I would be happy to help you.
Ganczarczyk, Marek 20 Reputation points

2025-02-24T16:22:27.0566667+00:00

that you for this answer unfortunately it didn't helped.
Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-24T17:51:03.1966667+00:00

Hi Ganczarczyk, Marek,

I understand the locked blob immutability policy is designed to ensure data integrity and compliance with regulatory requirements. Once a blob is locked with an immutability policy, it cannot be deleted or modified until the policy expires. This is to prevent accidental or malicious data loss

Ensure that there are no legal holds on the blobs or containers. Legal holds can also prevent deletion. If there are legal holds, you will need to remove them before you can delete the storage account
Sometimes, there might be a delete lock set on the storage account. You can check this in the Settings blade for the resource. If there is a delete lock, you can remove it and then try deleting the storage account again

Since a third-party software set the locked flag, you might want to evaluate its necessity and consider alternatives that do not impose such restrictive policies.

I hope this information helps! Let us know if you have any further questions. We will be glad to assist you further.

1 answer

Your answer

Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-18T18:44:16.3+00:00

Hi Ganczarczyk, Marek,

There are no legal holds applied to the blobs. Legal holds can prevent deletion even if the immutability policy has expired.If possible, try to modify or remove the immutability policy. You can use Azure CLI or Azure PowerShell for this. For example, using Azure CLI:

az storage blob immutability-policy delete --account-name <StorageAccountName> --container-name <ContainerName> --name <BlobName>

Once the policy is removed or modified, delete the blobs and containers. You can use Azure Storage Explorer or Azure PowerShell to do this. After all blobs and containers are deleted, you should be able to delete the storage account.

If the policy is locked and cannot be modified or removed, you may need to wait until the policy expires. Unfortunately, if the policy is set to expire in 2034, you might not be able to delete the storage account until then.

For more information:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

https://learn.microsoft.com/en-us/rest/api/storagerp/blob-containers/delete-immutability-policy?view=rest-Required fields are marked with asterisk/starDisplay text Address SaveRemovestoragerp-2023-05-01&tabs=HTTP

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Ganczarczyk, Marek 20 Reputation points

2025-02-19T08:38:36.4733333+00:00

What if I don't to pay for that? Orphan whole subscription or tenant? That is the case. 3rd party software set this locked flag and it is cost:1500$. so the open question is: under Azure am I administrator or not? at on-premise I can remove whole array, destroy disks. Azure seems to be money machine for MS
Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-20T19:08:32.2833333+00:00

Hi Ganczarczyk, Marek,

I understand immutability policies are designed to ensure data integrity and compliance, which can sometimes make deletion challenging. Few points to consider

As an Azure administrator, you have significant control over resources, but certain policies, like immutability, are designed to be tamper-proof to meet compliance requirements

This is different from on-premises environments where you might have more direct control over hardware.

If the immutability policy was set by third-party software and is causing unexpected costs, you might want to explore Azure's cost management tools to better understand and manage your expenses.

For more information:
https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you
Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-21T16:43:31.0866667+00:00

Hi Ganczarczyk, Marek,

Just checking in to see if the response helped. If you have any questions, let me know in the "comments" and I would be happy to help you.
Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-24T16:14:38.71+00:00

Hi Ganczarczyk, Marek,

Just checking in to see if the response helped. If you have any questions, let me know in the "comments" and I would be happy to help you.
Ganczarczyk, Marek 20 Reputation points

2025-02-24T16:22:27.0566667+00:00

that you for this answer unfortunately it didn't helped.
Keshavulu Dasari 4,375 Reputation points Microsoft External Staff

2025-02-24T17:51:03.1966667+00:00

Hi Ganczarczyk, Marek,

I understand the locked blob immutability policy is designed to ensure data integrity and compliance with regulatory requirements. Once a blob is locked with an immutability policy, it cannot be deleted or modified until the policy expires. This is to prevent accidental or malicious data loss

Ensure that there are no legal holds on the blobs or containers. Legal holds can also prevent deletion. If there are legal holds, you will need to remove them before you can delete the storage account
Sometimes, there might be a delete lock set on the storage account. You can check this in the Settings blade for the resource. If there is a delete lock, you can remove it and then try deleting the storage account again

Since a third-party software set the locked flag, you might want to evaluate its necessity and consider alternatives that do not impose such restrictive policies.

I hope this information helps! Let us know if you have any further questions. We will be glad to assist you further.

Answer 1

Hello Ganczarczyk,

Thank you for reaching out to Microsoft Q&A.
You cannot delete a storage account with a locked immutable policy, Since the blob is locked until 2034, deletion will only be possible after this date. (3/8/2034 12:00:00 AM +00:00)

Workaround:
**1.**If you can create a new version of the blob with an overwrite operation (if versioning is enabled), you might be able to delete the previous version.
2.Migrate to a New Storage Account & Retire the Old One

If the data is no longer needed but deletion is blocked:

Create a new storage account and move active resources there.
Disable all access to the old storage account to prevent unnecessary costs.
Set a reminder for the expiration date (March 8, 2034) to delete it then.

You cannot delete a storage account with a locked immutable policy, and Microsoft Support cannot override it. The only way to delete it is to wait for the policy to expire in 2034.

If You find this information helpful, please do not forget to accept the answer.

Share via

Azure Remove completely storage account with locked policy

1 answer

Your answer