[Priority Developer Support] Unable to delete Backup Instance/Vault due to Immutable Lock - Need Escalation

Question

[Priority Developer Support] Unable to delete Backup Instance/Vault due to Immutable Lock - Need Escalation

Aviv 0

Hi Azure Support Team,

I am on a Developer Support Plan and require technical assistance to resolve a blocker regarding a Backup Vault deletion.

The Goal: I need to delete the Backup Vault and its associated instances.

The Blocker: The vault has an Immutable Lock enabled. When attempting to remove the backup instances to clear the vault, I receive the following error:

UserErrorDeleteBackupItemOnImmutableItem: The Backup Item(s) cannot be deleted since it has active recovery points and the selected Vault is an immutable vault.

Steps Taken:

Confirmed the DatasourceType is AzureDatabaseForPGFlexServer.

Attempted deletion via PowerShell: Remove-AzDataProtectionBackupInstance.

Received the error indicating that the Immutable vault status prevents deletion of items with active recovery points.

Since I am unable to manually bypass the immutability policy or delete the instances to clear the vault, I require a Support Engineer to review if a backend "Break-Glass" procedure is possible or if the lock state can be modified for this specific resource.

Suchitra Suregaunkar 13,030 Reputation points Microsoft External Staff Moderator

2026-03-17T00:26:42.5166667+00:00
Hello @Aviv

Because your vault is configured as an immutable vault, Azure will block any operation that deletes recovery points before their expiry dates. Here’s the high-level flow to remove everything and delete the vault—assuming your immutability setting is not already locked irreversibly:

Check the vault’s immutability state: • In the Azure portal, go to your Recovery Services Vault → Properties → Immutable Settings. • If the setting shows “Enabled” (but not locked), you can turn it off here (or via PowerShell) to allow deletions. • If it’s in the “Enabled and locked” state, that lock is irreversible—there is no supported “break-glass” backend procedure to disable immutability.

Disable immutability (if it isn’t locked) : • Portal: toggle Immutable Settings to “Disabled” → Save • PowerShell (example):
$vault = Get-AzRecoveryServicesVault –Name "<vaultName>" –ResourceGroup "<rg>" $vault.ImmutableVault = $false Set-AzRecoveryServicesVault –Vault $vault

Stop protection and delete backup data for each backup item : • Portal: Recovery Services Vault → Backup Items → select your AzureDatabaseForPGFlexServer item → Stop backup → choose “Delete backup data.” • PowerShell: use Stop-AzDataProtectionBackupInstance (or Stop-AzRecoveryServicesBackupProtection) with the appropriate flags to remove recovery points.

Purge soft-deleted items (if soft delete is enabled on the vault) : • Portal: Vault → Properties → Soft delete → temporarily disable if needed → delete any soft-deleted items → re-enable soft delete.

Clean up any protected servers or storage accounts : • Vault → Backup infrastructure → Protected Servers / Storage Accounts → unregister or delete all entries.

Delete the vault : • Once there are no backup items, soft-deleted objects, or protected-server dependencies, go to Vault → Overview → Delete.

Could you please share us the below details?

What exact state do you see under Immutable Settings “Enabled” or “Enabled and locked”?

Is soft delete enabled on the vault?

Are there any Multi-User Authorization (MUA) or Privileged Identity Management policies governing this vault?

Can you share the Azure region of the vault?

Thanks,

Suchitra.
Aviv 0 Reputation points

2026-03-17T08:31:28.2833333+00:00

Hi Suchitra Suregaunkar,

Thank you for your assistance. I have performed a deep dive into the vault settings and identified a critical blocker that requires backend intervention.

Current Findings:

Region: Israel Central

Vault Security State: Immutable Vault: Enabled | Locked

Soft Delete: Disabled

The Conflict: Because the legacy vault is in a Locked immutable state, the datasource (PostgreSQL Flexible Server) remains permanently mapped to this vault.

Error Encountered: When attempting to migrate protection to a new V2 vault, I receive UserErrorDppDatasourceAlreadyHasBackupInstance.

PowerShell Failure: Attempts to sync or update the instance fail with UserErrorInvalidRequestParameter due to a current ProtectionStopped status.

Since the vault is in a Locked state, I understand the recovery points themselves cannot be deleted until expiry. However, this is preventing me from protecting my production database in a new environment.

Could you please open a private support case or provide a secure channel so I can share the following sensitive details:

Specific Subscription ID and Resource Names (currently scrubbed for this public thread).

The Correlation IDs and Activity IDs for the failed disassociation attempts.

Request for a backend disassociation/unlinking of the datasource from the locked vault.

I need to move my database protection to the new vault immediately while allowing the legacy vault to expire naturally in the background.

Best regards, Aviv
Suchitra Suregaunkar 13,030 Reputation points Microsoft External Staff Moderator

2026-03-17T18:38:52.37+00:00

Hello @Aviv

Thanks for sharing the details. We will check with backend team and assist you on this issue.

Thanks,

Suchitra.
Suchitra Suregaunkar 13,030 Reputation points Microsoft External Staff Moderator

2026-03-18T17:24:38.78+00:00

Hello @Aviv

We have an update that removing the immutability lock requires backend intervention and customer authorization due to security concerns, including potential ransomware risks. The process to remove the lock can take around 30 days.

We will keep you posted further updates.

Thanks,
Suchitra.
Suchitra Suregaunkar 13,030 Reputation points Microsoft External Staff Moderator

2026-04-03T08:48:22.5433333+00:00

Hello @Aviv

I wanted to share an update that PG team has been applied fix on this issue and After April 15th you can able to delete backup vault.

Thank You.
Aviv 0 Reputation points

2026-04-03T10:01:25.19+00:00

Hello @Suchitra Suregaunkar ,

Thank you very much for the update and for coordinating this fix with the Product Group (PG) team.

I appreciate the transparency regarding the backend intervention and the specific timeline provided. I have noted that the vault will be eligible for deletion after April 15th.

This resolution is a major help in decommissioning our legacy infrastructure in the Israel Central region and resolving the datasource mapping conflict we were experiencing. I will monitor the vault for deletion after the specified date.

Thank you again for your dedicated support on this case!

Best regards,

Aviv

1 answer

Your answer

Aviv 0 Reputation points

2026-03-17T08:31:28.2833333+00:00

Hi Suchitra Suregaunkar,

Thank you for your assistance. I have performed a deep dive into the vault settings and identified a critical blocker that requires backend intervention.

Current Findings:

Region: Israel Central

Vault Security State: Immutable Vault: Enabled | Locked

Soft Delete: Disabled

The Conflict: Because the legacy vault is in a Locked immutable state, the datasource (PostgreSQL Flexible Server) remains permanently mapped to this vault.

Error Encountered: When attempting to migrate protection to a new V2 vault, I receive UserErrorDppDatasourceAlreadyHasBackupInstance.

PowerShell Failure: Attempts to sync or update the instance fail with UserErrorInvalidRequestParameter due to a current ProtectionStopped status.

Since the vault is in a Locked state, I understand the recovery points themselves cannot be deleted until expiry. However, this is preventing me from protecting my production database in a new environment.

Could you please open a private support case or provide a secure channel so I can share the following sensitive details:

Specific Subscription ID and Resource Names (currently scrubbed for this public thread).

The Correlation IDs and Activity IDs for the failed disassociation attempts.

Request for a backend disassociation/unlinking of the datasource from the locked vault.

I need to move my database protection to the new vault immediately while allowing the legacy vault to expire naturally in the background.

Best regards, Aviv
Suchitra Suregaunkar 13,030 Reputation points Microsoft External Staff Moderator

2026-03-17T18:38:52.37+00:00

Hello @Aviv

Thanks for sharing the details. We will check with backend team and assist you on this issue.

Thanks,

Suchitra.
Suchitra Suregaunkar 13,030 Reputation points Microsoft External Staff Moderator

2026-03-18T17:24:38.78+00:00

Hello @Aviv

We have an update that removing the immutability lock requires backend intervention and customer authorization due to security concerns, including potential ransomware risks. The process to remove the lock can take around 30 days.

We will keep you posted further updates.

Thanks,
Suchitra.
Suchitra Suregaunkar 13,030 Reputation points Microsoft External Staff Moderator

2026-04-03T08:48:22.5433333+00:00

Hello @Aviv

I wanted to share an update that PG team has been applied fix on this issue and After April 15th you can able to delete backup vault.

Thank You.
Aviv 0 Reputation points

2026-04-03T10:01:25.19+00:00

Hello @Suchitra Suregaunkar ,

Thank you very much for the update and for coordinating this fix with the Product Group (PG) team.

I appreciate the transparency regarding the backend intervention and the specific timeline provided. I have noted that the vault will be eligible for deletion after April 15th.

This resolution is a major help in decommissioning our legacy infrastructure in the Israel Central region and resolving the datasource mapping conflict we were experiencing. I will monitor the vault for deletion after the specified date.

Thank you again for your dedicated support on this case!

Best regards,

Aviv

Answer 1

Suchitra Suregaunkar 13,030 Microsoft External Staff Moderator

Hello @Aviv

Thank you for posting your query on Microsoft Q&A platform.

We have an update that removing the immutability lock requires backend intervention and customer authorization due to security concerns, including potential ransomware risks.

This restriction was supposed to be lifted on 15/04 but was extended by another 2 weeks due to unavoidable circumstances.

So, I wanted to share an update that PG team has been applied fix on this issue and After April 28th you can able to delete backup vault.

Thanks,

Suchitra.

Suchitra Suregaunkar 13,030 Reputation points Microsoft External Staff Moderator

2026-04-07T12:07:12.9333333+00:00

Hello @Aviv

If the answer is helpful, could you please click "Accept Answer" & "upvote" it and this helps other community members who may encounter a similar issue in the future.

If you’re still experiencing the problem or need further clarification, please feel free to share additional information so we can continue investigating and assist you further.

Thanks,

Suchitra.

Share via

[Priority Developer Support] Unable to delete Backup Instance/Vault due to Immutable Lock - Need Escalation

1 answer

Your answer