Unable to delete DDos Protection

Question

I have deployed Azure landing zone into my MPN subscription now strugling for 4 months to remove the solution. First problem was it always depleted the money in first days after billing period removal. I managed to delete somthing.

Now I'm stuck at DDos Protection which i cannot delete as it say it needs to be removed from some VNET but the vnet is already gone, how to delete DDoS protection from VNET that has been already deleted?

This is not first time I have been is such a deadlock with Azure. Is there a way how to resolve the issue?

Answer 1

Hi zveratko

Thanks for using the Q&A platform.

You're encountering a common issue in Azure where a DDoS Protection Plan is still associated with a now-deleted VNet, and Azure won't let you delete the plan due to that ghost association.

Run the following Azure CLI to confirm which (if any) VNets are still linked:

az network ddos-protection show --name <ddos-plan-name> --resource-group <resource-group> 

Look under the "virtualNetworks" section. If it shows a VNet that no longer exists, it means Azure still thinks it’s associated, even if it’s orphaned. However, if the output is empty, it is safe to delete.

You can try using the following command:

az network ddos-protection delete \
  --name <ddos-plan-name> \
  --resource-group <resource-group>

Find additional documentation: https://learn.microsoft.com/en-us/cli/azure/network/ddos-protection?view=azure-cli-latest

If Azure still won't allow you to delete the DDoS plan because it thinks a VNet is attached, even though it's gone, you will need to open a Microsoft support ticket to remove orphaned associations on the backend.

If the response was helpful, please feel free to mark it as “Accepted Answer” and consider giving it an upvote. This also benefits others in the community.

Regards,

Obinna.

Answer 2

Hello zveratko

I understand you are unable to delete the DDOS protection plan and unable to diss-associate from the Virtual Network as it has been deleted and only the DDOS protection plan remains.

DDoS protection plans cannot be deleted if they are associated with a virtual network. So the first step is to disassociate both objects. Although the VNET is deleted, I think it is still worth a try and see if you can still try to diss-associate the DDOS plan from the Virtual Network using Azure CLI as shown here and see if that helps in deletion.

Azure CLICopy

az network vnet update 

Follow this command if it is DDOS IP Protection plan.

If not tried already another approach you can take here is to try and remove the DDOS plan using PowerShell Command shown here.

Refer: https://learn.microsoft.com/en-us/powershell/module/az.network/remove-azddosprotectionplan?view=azps-14.2.0&viewFallbackFrom=azps-10.3.0#example-1-remove-an-empty-ddos-protection-plan

Azure PowerShellCopy

Remove-AzDdosProtectionPlan -ResourceGroupName

If you are still unable to delete the DDOS plan, I think a support ticket will be required in this case as a support engineer can involve backend team to help resolve this issue

---

I hope this helps! If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

If the above is unclear or you are unsure about something, please add a comment below.