A cloud-based identity and access management service for securing user authentication and resource access
The tenant deletion check can still be blocked by hidden or system enterprise applications (service principals) that don’t appear in the Enterprise applications blade. These must be removed or disabled by using Microsoft Graph and Az PowerShell, then the deletion can be retried.
Follow these steps:
- Install the required PowerShell modules
Install-Module Microsoft.Graph Install-Module -Name Az - Connect to the tenant to be deleted (as a homed Global Administrator)
RunConnect-MgGraph -Scopes "Application.ReadWrite.All"Get-MgDomainto verify the connected tenant ID andonmicrosoft.comdomain. - Verify Az context for the same tenant (safety check)
Confirm the tenant ID and domain match the tenant that should be deleted. Do not skip this step to avoid deleting apps in the wrong tenant.Clear-AzContext -Scope CurrentUser Connect-AzAccount -Tenant <object id of the tenant you are attempting to delete> Get-AzContext - Remove all service principals (enterprise apps)
Run the following command multiple times until no more service principals can be removed:
Get-MgServicePrincipal -All | ForEach-Object { Remove-MgServicePrincipal -ServicePrincipalId $_.Id } - If some service principals cannot be deleted, disable and retry
$ServicePrincipalUpdate = @{ "accountEnabled" = "false" } Get-MgServicePrincipal -All | ForEach-Object { Update-MgServicePrincipal -ServicePrincipalId $_.Id -BodyParameter $ServicePrincipalUpdate } Get-MgServicePrincipal -All | ForEach-Object { Remove-MgServicePrincipal -ServicePrincipalId $_.Id } - After the service principals are removed/disabled, go back to the Microsoft Entra admin center and retry tenant deletion from Entra ID → Overview → Manage tenants → Delete.
This clears hidden enterprise applications that are not visible in the portal list but still block tenant deletion.
References: