Failed to load the resource snapshot. Parent resource with id '/subscriptions/xxxxxxxxx/resourceGroups/xxxxxxxxxxxxx/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net' may have been delete

Question

Hi All,

Will this process clear on its own? It seems to be stuck. I was moving a privatelink to a different RG via the UI.

Failed to load the resource snapshot. Parent resource with id '/subscriptions/xxxxxxxxxxxx/resourceGroups/xxxxxxxxx/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net' may have been deleted. If the parent resource does exist, please provide below info when asking for support: timestamp = 2026-04-14T18:26:40.000Z, correlationId = 0d0c4b85-a8ed-4bfa-bd8c-0c218cfe91ad. (Code: 404)"

If I try to move something else I get this message:
(ResourcesBeingMoved) The resource group 'xxxxxxxxxxx' is being updated and cannot perform this operation.

Answer 1

The behavior is consistent with a resource group that is still in a move/update operation. While the move is in progress, the source and destination resource groups are locked and most operations (including other moves) are blocked. This can last for up to four hours.

Key points from the move behavior and limitations:

1. During a move, both source and target resource groups are locked
   • No create, delete, or update operations are allowed on resources in those groups while the move runs.
   • Existing resources continue to function, but management operations fail with errors similar to what is being seen.
   • The lock can last up to four hours; most moves complete faster, but a stuck or failed move can hold the lock until Azure completes or fails the operation.
2. Private endpoint / private DNS move limitations
   • Only certain private-link resources support move. For networking, Microsoft.aadiam/privateLinkForAzureAD is explicitly listed as movable.
   • The error mentioning the parent Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net indicates the portal is trying to load a snapshot of a resource whose parent DNS zone is in an inconsistent state (for example, mid-move or recently deleted).
   • A private endpoint must be in Succeeded state before attempting a move.
3. What typically happens next
   • If the move operation is valid, Azure completes it and releases the lock automatically. At that point, the resource group and resources become manageable again.
   • If the move fails, the provisioning state should eventually change to a failed state, after which delete or re-create operations usually become possible (similar to other stuck resources that can be deleted once they transition to Failed).
4. Recommended actions
   • Wait for the move operation to complete or fail. Because the platform enforces a lock during the move, manual intervention is limited until the operation finishes.
   • After some time, retry loading the resource and the resource group in the portal.
   • Once the move has either succeeded or failed and the lock is released:
     • If the parent private DNS zone exists and is healthy, retry the move or re-create the private endpoint/association as needed.
     • If the resource ends up in a failed or orphaned state, delete and re-create it in the desired resource group.

If the resource group remains locked beyond the typical move window (for example, several hours) and the portal still shows the same error, open a support case and provide the timestamp and correlationId from the error so Azure Support can inspect and clear the stuck move operation.

---

References:

• Move Azure resources to a new resource group or subscription
• Move networking resources to new resource group or subscription
• Azure resource types for move operations
• Move Azure resources across resource groups, subscriptions, or regions