Need to delete an immutable backup vault which is not used

Question

Need to delete an immutable backup vault which is not used

Jeff Powell 0

We have a backup service vault (Name), which we are not using. The service which was being backed up no longer exists. Since we no longer need this Azure backup vault, we would like to delete it. However, since the vault is marked immutable (or something similar to that) we are unable to delete it. Any helpful suggestions?

Suchitra Suregaunkar 3,545 Reputation points Microsoft External Staff Moderator

2025-12-03T23:44:10.5266667+00:00
Hello Jeff Powell

Thank you for posting your query on Microsoft Q&A platform.

As you can’t delete a Recovery Services vault because it’s protected by Azure Backup safeguards such as Soft Delete, Immutable vault, Resource Guard (MUA), or there are residual backup/ASR dependencies.

As a resolution follow below steps in order:

Verify what’s blocking deletion:

In the vault (Properties → Security/Immutable/MUA):

Soft Delete: Vault can’t be deleted while any backup items are in soft‑deleted state (they auto‑purge after 14 days).

Immutable vault: If immutability is enabled and locked, operations that could cause loss of recovery points (including delete‑backup‑data) are blocked until retention expires, deletion of the vault will only be possible after all items/windows have elapsed.

Multi‑User Authorization (Resource Guard): Critical ops (e.g., disable soft delete, stop+delete backup data) may require the MUA approval/PIN.

Also check for resource locks and ASR infrastructure (fabrics/policies/replicated items).

Remove backup dependencies:

For each protected item (Azure VM, SQL/SAP HANA in VM, Azure Files, MARS/MABS/DPM):

Stop backup and choose Delete backup data (preferred when the vault is being retired). This moves the item into soft‑deleted for 14 days (no charge). You cannot delete the vault until no items remain in soft‑deleted state.

If policy allows and you must avoid the wait: Disable Soft Delete, then undelete + delete again to permanently remove right away (note: MUA may protect this operation).

PowerShell reference for stopping protection and (optionally) removing recovery points: Disable‑AzRecoveryServicesBackupProtection -RemoveRecoveryPoints (older docs name this “Stop backup”). Reference: https://learn.microsoft.com/en-us/powershell/module/az.recoveryservices/disable-azrecoveryservicesbackupprotection?view=azps-15.1.0&viewFallbackFrom=azps-14.3.0

Remove Azure Site Recovery (ASR) dependencies (if the vault was used for DR):

Disable replication for every protected machine, then delete replication policies, fabrics, and other infrastructure.

You can remove ASR fabrics via PowerShell/CLI/REST if needed.

Understand Immutable vault behavior (if enabled):

Enabled: Restricted operations that could reduce retention or delete data are blocked.

Locked (WORM): The setting is irreversible and backup data can’t be deleted before policy expiry, vault deletion is effectively blocked until all recovery points and windows expire.

When all items are gone (and any soft‑delete/immutability windows have elapsed): Delete the vault using Portal/PowerShell/CLI.

Example PowerShell cmdlet: Remove‑AzRecoveryServicesVault -Vault $vault

Thanks,

Suchitra.
Suchitra Suregaunkar 3,545 Reputation points Microsoft External Staff Moderator

2025-12-05T13:34:35.8766667+00:00

Hello Jeff Powell

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

Thanks,

Suchitra.

1 answer

Your answer

Suchitra Suregaunkar 3,545 Reputation points Microsoft External Staff Moderator

2025-12-05T13:34:35.8766667+00:00

Hello Jeff Powell

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

Thanks,

Suchitra.

Answer 1

To delete an immutable Azure Backup vault, you need to first disable the immutability feature. This typically involves the following steps:

Disable Soft Delete: If the soft delete feature is enabled on the vault, you will need to disable it. You can do this by going to Properties -> Security Settings in the vault and disabling the Soft Delete feature.
Remove Protected Items: Ensure that all backup items and protected data sources associated with the vault are deleted. You can do this by navigating to Backup Instances in the vault and deleting any listed items.
Check for Dependencies: Make sure there are no dependencies such as registered storage accounts or private endpoints. Unregister any storage accounts and remove any private endpoints if they exist.
Delete the Vault: Once all dependencies are cleared, you can proceed to delete the vault from the Azure portal by selecting Delete on the vault dashboard and confirming the deletion.

If you encounter issues during this process, ensure that you have the necessary permissions and that all items are indeed removed before attempting to delete the vault again.

References:

Delete an Azure Backup Recovery Services vault

Share via

Need to delete an immutable backup vault which is not used

1 answer

Your answer