Azure Container Apps
An Azure service that provides a general-purpose, serverless container platform.
687 questions
Delete an Azure resources with remaining DenyAssignments from ContainerApps
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 94%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMZ%3C/text%3E%3C/svg%3E)
Marcus Zethraeus
0
Reputation points
Hi Microsoft Team,
I'm unable to delete a resource group due to system-protected deny assignments that were automatically created by a now-deleted Azure Container App managed environment.
Details:
- Resource Group:
predli-xxxx-internal
Subscription ID: 817ae3be-xxxx-xxxx-8223-dc5cc95ab162
Container App Environment: Deleted
Remaining Resources:
Public IP: capp-xxxx-lb
Load Balancer: capp-xxxx-lb
These resources still have the following `isSystemProtected: true` deny assignments:
`/subscriptions/817ae3be-ebae-xxxx-xxxx-dc5cc95ab162/resourceGroups/predli-xxxx-internal/providers/Microsoft.Network/loadBalancers/capp-xxxx-lb/providers/Microsoft.Authorization/denyAssignments/8e2fdc65-fd6c-xxxx-xxxx-d84fedf3d59d`
`/subscriptions/817ae3be-ebae-xxxx-xxxx-dc5cc95ab162/resourceGroups/predli-xxxx-internal/providers/Microsoft.Authorization/denyAssignments/3a4f275a-4f5d-xxxx-xxxx-e7dbb02d33f3`
`/subscriptions/817ae3be-ebae-xxxx-xxxx-dc5cc95ab162/resourceGroups/predli-xxxx-internal/providers/Microsoft.Network/publicIPAddresses/capp-xxxx-lb-ip/providers/Microsoft.Authorization/denyAssignments/18bcac05-1e78-xxxx-xxxx-8592e4122820`
I have verified that no Container App or Environment exists anymore (`az containerapp env list` returns empty), but I am blocked from deleting these resources or the group.
**Request**: Please assist in removing these orphaned deny assignments or escalating to an internal team that can clean them up.
Thank you!
Azure Container Apps
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 40%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKA%3C/text%3E%3C/svg%3E)
Khadeer Ali 5,990 Reputation points Microsoft External Staff Moderator2025-06-19T13:46:39.4133333+00:00 The deny assignments you're seeing are system-protected and were automatically created by the Azure Container Apps managed environment. Although the environment has been deleted, these deny assignments were not automatically cleaned up.
As these are not removable by users, I’ll go ahead and escalate this internally to have the orphaned deny assignments cleaned up.
We’ll keep you updated on the progress.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 5%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPK%3C/text%3E%3C/svg%3E)
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator2025-06-19T15:25:28.6033333+00:00 Hello @Marcus Zethraeus ,
Could you please check the private message and provide the required details for troubleshooting the issue further.
Here is the reference link on how to access & data retention policy of private messages in Microsoft Q&A.
-
Khadeer Ali 5,990 Reputation points Microsoft External Staff Moderator
2025-06-20T16:26:33.1166667+00:00 Just checking if you got a chance to look into the private message and provide the requested details
-
Marcus Zethraeus 0 Reputation points
2025-06-22T15:50:51.7033333+00:00 Thanks for the escalation. I've responded now in the private message.
-
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator
2025-06-23T03:55:47.4866667+00:00 Is System Protected
- System Protection: When an assignment is marked as
isSystemProtected: true, it indicates that the deny assignment was created by Azure services (such as Blueprints, Deployment Stacks, or Managed Applications) and is essential for protecting resources. Users do not have the ability to edit or delete these deny assignments directly. - Created by Azure: These assignments can often arise in scenarios such as:
- Managed resource groups created automatically by services (e.g., Azure Databricks).
- Policies enforced by Azure that prevent certain actions on resources.
Please follow below document to List Azure deny assignments.
- System Protection: When an assignment is marked as
-
Marcus Zethraeus 0 Reputation points
2025-06-23T12:17:56.4233333+00:00 Yes, the Load Balancer and Public IP created by the Container App are both System Protected.
I will need help from a MS support team to remove the resources.
-
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator
2025-06-24T04:17:05.75+00:00 Hello @Marcus Zethraeus , Thanks for your patience on this. Upon deeper investigations internal team has reviewed the logs and confirmed that there is another active container app environment (predli-stxxxio-intexxx) which is blocking the deletion of container apps. Could you please try deleting that container app environment and let us know if you are still facing the issue.
I have shared you more information in the private message please do check and let me know.
-
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator
2025-06-27T05:53:16.96+00:00 Hello @Marcus Zethraeus ,
Following up to see if you have chance to check my previous response and please let us know with an update to assist you further on this.
Sign in to comment
Sign in to answer