Unable to delete CIAM directory resource – tenant never provisioned, cannot elevate permissions, support blades fail

Question

Unable to delete CIAM directory resource – tenant never provisioned, cannot elevate permissions, support blades fail

Tim Salmon 30

I have a CIAM directory resource in my Azure subscription that was created in a failed or incomplete state. The ARM resource exists, but the corresponding Entra tenant never provisioned. Because of this, I cannot switch into the directory, cannot elevate myself to Global Administrator, and cannot delete the resource.

Attempts to delete the CIAM directory resource return:

“(Forbidden) You don’t have access. Only Global Administrators for this directory can manage its settings.”

However, the directory does not appear in my tenant list, and there is no way to become a Global Administrator of it because the tenant itself does not exist.

Additional symptoms:

The Entra portal cannot load support or troubleshooting blades (ErrorLoadingExtensionAndDefinition).

The Azure Portal support request flow fails to load.

I am using a Microsoft Personal Account, and Microsoft no longer allows MSAs to create Entra tenants, so I cannot create a work/school account to open a support ticket.

The resource group cannot be deleted because the CIAM directory resource blocks deletion.

Azure CLI deletion fails with the same “Only Global Administrators…” error.

The CIAM directory does not appear in az account tenant list.

This appears to be a stranded CIAM directory resource that requires backend removal by Microsoft.

Resource ID:

Code

/subscriptions/<pii removed>/resourceGroups/WebTramplerDevInt/providers/Microsoft.AzureActiveDirectory/ciamDirectories/mywebappv3.onmicrosoft.com

Subscription ID: <PII REMOVED>

Could someone from Microsoft please escalate this to the identity engineering team to remove the stranded CIAM directory resource? I cannot delete it through any self-service method.

Thank you.

Shubham Sharma 10,565 Reputation points Microsoft External Staff Moderator

2026-03-03T01:43:22.8233333+00:00

Hello Tim Salmon

Thank you for reaching out to Microsoft Q&A.

Sounds like the CIAM directory resource got left in an incomplete state and you effectively have no tenant to manage or delete it. Since the usual self-service deletion paths (portal, CLI, support blades) all require a provisioned tenant and Global Admin rights, the only way out here is a back-end removal by the identity engineering team.

I’ve gone ahead and opened an internal escalation for you, but they’ll need a few more details to track down and permanently remove that stranded resource. Could you reply the details in private chat :-

Once we have those, we’ll pass everything straight to the identity team for removal. Thanks for your patience!

Reference docs for similar “tenant deletion” scenarios (for your info):

• Delete a CIAM Tenant: https://supportabilityhub.microsoft.com/solutions/apollosolutions/5c3cceb3-6b16-45b1-c776-055e041e191e

• Delete a tenant in Microsoft Entra ID: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/directory-delete-howto

• Troubleshooting tenant deletion (apps, subscriptions, users): https://learn.microsoft.com/troubleshoot/entra/entra-id/dir-dmns-obj/cannot-delete-directory-azure-portal

• Delete B2C directory error (“Cannot delete ‘<contoso>’”): https://learn.microsoft.com/troubleshoot/entra/entra-id/b2c/cannot-delete-directory

1 answer

Your answer

Shubham Sharma 10,565 Reputation points Microsoft External Staff Moderator

2026-03-03T01:43:22.8233333+00:00

Hello Tim Salmon

Thank you for reaching out to Microsoft Q&A.

Sounds like the CIAM directory resource got left in an incomplete state and you effectively have no tenant to manage or delete it. Since the usual self-service deletion paths (portal, CLI, support blades) all require a provisioned tenant and Global Admin rights, the only way out here is a back-end removal by the identity engineering team.

I’ve gone ahead and opened an internal escalation for you, but they’ll need a few more details to track down and permanently remove that stranded resource. Could you reply the details in private chat :-

Once we have those, we’ll pass everything straight to the identity team for removal. Thanks for your patience!

Reference docs for similar “tenant deletion” scenarios (for your info):

• Delete a CIAM Tenant: https://supportabilityhub.microsoft.com/solutions/apollosolutions/5c3cceb3-6b16-45b1-c776-055e041e191e

• Delete a tenant in Microsoft Entra ID: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/directory-delete-howto

• Troubleshooting tenant deletion (apps, subscriptions, users): https://learn.microsoft.com/troubleshoot/entra/entra-id/dir-dmns-obj/cannot-delete-directory-azure-portal

• Delete B2C directory error (“Cannot delete ‘<contoso>’”): https://learn.microsoft.com/troubleshoot/entra/entra-id/b2c/cannot-delete-directory

Answer 1

Because the authorization check happens inside the Entra service, not ARM. Only Microsoft backend engineers can resolve this. This requires a Microsoft Support backend ticket routed to Microsoft Entra ID/CIAM Engineering Backend Directory Provisioning Team. It looks like you are using a Microsoft Personal Account, and Microsoft no longer allows MSAs to create Entra tenants. However, there's no need to worry about creating a tenant just to open a subscription support case. Remember, support is linked to the subscription itself, not the tenant.

How To Open a Support Case Without a Tenant

Since portal support is failing to load, follow the steps below:

Open

https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade

If that fails, use

https://azure.microsoft.com/en-us/support/create-ticket/

Sign in with your Microsoft account tied to the subscription.

Select --> Issue type: Technical

Service: Microsoft Entra ID

Problem type: CIAM

Severity: Minimal (or higher if blocking prod)

If Entra ID is not selectable, choose:

Service: Subscription Management

Problem type: Other

Explain clearly that a CIAM directory ARM resource exists without a provisioned Entra tenant and requires backend removal.

I hope this works.

Tim Salmon 30 Reputation points

2026-03-01T21:40:20.4433333+00:00

Hello Gulnaz,

Thanks very much for your prompt response. Rather unexpected on Sunday.

Unfortunately, the more pressing problem for me is not one of deleting the CIAM directory, but actually creating a support call in the first place. Both of your links direct me back to the infuriatingly circular Q and A which ends with no answer and no way of contacting an engineer. Which is why I posted here.

I understand that there is a technical support subscription extension that I have used in the past, but, considering that the underlying problem is due to a failure in Microsoft Azure's own management routines, I am very loth to sign up for this. Especially as I am migrating away from Azure.

I would be appreciative of any constructive means of progress.

Thankyou for your time

Tim.

Share via

Unable to delete CIAM directory resource – tenant never provisioned, cannot elevate permissions, support blades fail

1 answer

Your answer