Virtual Network Gateway resource (Basic SKU) will not delete

Question

Virtual Network Gateway resource (Basic SKU) will not delete

Matt Wehrman 0

I have a virtual network gateway with a Basic SKU. It had one connection, which is removed and I deleted the ip address resource associated to it. I am trying to delete the virtual network gateway resource so I can rebuild it with more appropriate sku.

I have tried a few ways to reset the resource. I tried to kick to from failed state to active state. I tried resetting the resource and then deleting it. I tried command line and portal actions, all giving the same result.

When I look at the activity log for the delete activity that fails I get this message: "The resource operation completed with terminal provisioning state 'Failed'."

How can I proceed?

I don't want to have to build a new virtual network just because this one resource will not delete.

What actions should I take?

Thank you,

Matt

Vinayteja Lellela 90 Reputation points Microsoft External Staff Moderator

2026-07-07T19:17:58.32+00:00
Hello Matt Wehrman,

You’re running into that. Based on the documentation provided, the troubleshooting guidance we have available is specifically for a different error (SubnetWithNatGatewayAndBasicSkuResourceNotAllowed) related to attaching a NAT Gateway to a subnet that contains Basic SKU resources. It doesn’t cover why a Virtual Network Gateway (Basic SKU) delete operation would fail with:

“The resource operation completed with terminal provisioning state 'Failed'.”

We also have documentation about:

Removing the Basic public IP reference from an existing Basic SKU VPN gateway (for a specific portal scenario), and

Some legacy SKU notes, but nothing in the supplied materials directly explains how to force-delete a Basic SKU virtual network gateway when delete keeps failing.

What you can try

If your Basic SKU VPN gateway is specifically using a Basic SKU public IP “reference” in its configuration, the following doc is the closest match we have:

In the Azure portal, go to your Virtual network gateway resource.

Go to Settings > Configuration.

In the Validation section, verify all resources show Succeeded.

Then select Delete Basic Public IP Reference (this removes the reference; it notes there’s no network interruption, and your gateway public IP remains the same).

This is intended for the Basic SKU VPN gateway configuration cleanup scenario. The doc also explicitly states that Microsoft won’t automatically modify/clean up this reference for you.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Matt Wehrman 0 Reputation points

2026-07-08T02:40:33.2866667+00:00

I reviewed the configuration. Initially, there was one item showing failed. I did go out and manually delete the ip address being used by the gateway. Then when I went to "delete the reference" it is now stating no migration is necessary. "Your Gateway does not have a PublicIpAddress reference or is using a PublicIpAddress with Standard Sku. No migration is necessary."

Could it be that I executed steps out of order and now the resource is stuck?

1 answer

Your answer

Vinayteja Lellela 90 Reputation points Microsoft External Staff Moderator

2026-07-07T19:17:58.32+00:00

Hello Matt Wehrman,

You’re running into that. Based on the documentation provided, the troubleshooting guidance we have available is specifically for a different error (SubnetWithNatGatewayAndBasicSkuResourceNotAllowed) related to attaching a NAT Gateway to a subnet that contains Basic SKU resources. It doesn’t cover why a Virtual Network Gateway (Basic SKU) delete operation would fail with:

“The resource operation completed with terminal provisioning state 'Failed'.”

We also have documentation about:

Removing the Basic public IP reference from an existing Basic SKU VPN gateway (for a specific portal scenario), and

Some legacy SKU notes, but nothing in the supplied materials directly explains how to force-delete a Basic SKU virtual network gateway when delete keeps failing.

What you can try

If your Basic SKU VPN gateway is specifically using a Basic SKU public IP “reference” in its configuration, the following doc is the closest match we have:

In the Azure portal, go to your Virtual network gateway resource.

Go to Settings > Configuration.

In the Validation section, verify all resources show Succeeded.

Then select Delete Basic Public IP Reference (this removes the reference; it notes there’s no network interruption, and your gateway public IP remains the same).

This is intended for the Basic SKU VPN gateway configuration cleanup scenario. The doc also explicitly states that Microsoft won’t automatically modify/clean up this reference for you.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Matt Wehrman 0 Reputation points

2026-07-08T02:40:33.2866667+00:00

I reviewed the configuration. Initially, there was one item showing failed. I did go out and manually delete the ip address being used by the gateway. Then when I went to "delete the reference" it is now stating no migration is necessary. "Your Gateway does not have a PublicIpAddress reference or is using a PublicIpAddress with Standard Sku. No migration is necessary."

Could it be that I executed steps out of order and now the resource is stuck?

Answer 1

Jose Benjamin Solis Nolasco 9,531 Volunteer Moderator

Welcome to Microsoft Q&A

Hello @Matt Wehrman I hope you are doing well.

This can happen if a previous gateway operation (creation, update, connection removal, or deletion) did not complete successfully, leaving the resource in an inconsistent state.

Please check the following:

Verify that all dependent resources have been removed, including Local Network Gateways, Gateway Connections, and that the GatewaySubnet no longer contains any resources associated with the gateway.
Confirm there are no active resource locks (CanNotDelete or ReadOnly) on the gateway or its resource group.
Review the Activity Log for the failed delete operation and check for a more detailed inner error or correlation ID.

References

Delete a Virtual Network Gateway: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-delete-vnet-gateway-portal
Troubleshoot Azure VPN Gateway: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-troubleshoot

If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily.

Matt Wehrman 0

I went through the options and still the resource will not delete. The answer should work for most cases but for some reason this resource is stuck. I also reviewed the AI generated answer and it failed to resolve the issue.

The latest attempt to remove the resource using the power shell command gave this result;

$gw = Get-AzVirtualNetworkGateway -Name "resourcename" -ResourceGroupName "ResourceGroupName"
   Remove-AzVirtualNetworkGateway -Name "resourcename" -ResourceGroupName "ResourceGroupName"

Remove-AzVirtualNetworkGateway: Long running operation failed with status 'Failed'. Additional Info:'An error occurred.'
StatusCode: 200
ReasonPhrase: OK
Status: Failed
ErrorCode: InternalServerError
ErrorMessage: An error occurred.

Matt Wehrman 0 Reputation points

2026-07-08T12:45:48.53+00:00

I am not sure how to move this forward. I can't delete the vnet as it is used for other purposes. There is a peering on the vnet to another vnet. I could remove that and try to delete the gateway. Then add the peering back. What else could be in the way? Is there a way to find dependencies?