Azure Resource Manager resource group and resource deletion

Article
09/26/2024

This article shows how to delete resource groups and resources. It describes how Azure Resource Manager orders the deletion of resources when you delete a resource group.

Note

To delete a resource group, you must first remove any underlying resource locks and backup data.

How order of deletion is determined

When you delete a resource group, Resource Manager determines the order to delete resources. It uses the following order:

All the child (nested) resources are deleted.
Resources that manage other resources are deleted next. A resource can have the managedBy property set to indicate that a different resource manages it. When this property is set, the resource that manages the other resource is deleted before the other resources.
The remaining resources are deleted after the previous two categories.

After the order is determined, Resource Manager issues a DELETE operation for each resource. It waits for any dependencies to finish before proceeding.

For synchronous operations, the expected successful response codes are:

For asynchronous operations, the expected successful response is 202. Resource Manager tracks the location header or the azure-async operation header to determine the status of the asynchronous delete operation.

Deletion errors

When a delete operation returns an error, Resource Manager retries the DELETE call. Retries happen for the 5xx, 429 and 408 status codes. By default, the time period for retry is 15 minutes.

After deletion

Resource Manager issues a GET call on each resource that it tried to delete. The response of this GET call is expected to be 404. When Resource Manager gets a 404, it considers the deletion to have completed successfully. Resource Manager removes the resource from its cache.

However, if the GET call on the resource returns a 200 or 201, Resource Manager recreates the resource.

If the GET operation returns an error, Resource Manager retries the GET for the following error code:

Less than 100
408
429
Greater than 500

For other error codes, Resource Manager fails the deletion of the resource.

Important

Resource Group deletion is irreversible.

Delete resource group

Use one of the following methods to delete the resource group.

Remove-AzResourceGroup -Name ExampleResourceGroup

az group delete --name ExampleResourceGroup

import os
from azure.identity import AzureCliCredential
from azure.mgmt.resource import ResourceManagementClient

credential = AzureCliCredential()
subscription_id = os.environ["AZURE_SUBSCRIPTION_ID"]

resource_client = ResourceManagementClient(credential, subscription_id)

rg_result = resource_client.resource_groups.begin_delete("exampleGroup")

Delete resource

Use one of the following methods to delete a resource.

Remove-AzResource `
  -ResourceGroupName ExampleResourceGroup `
  -ResourceName ExampleVM `
  -ResourceType Microsoft.Compute/virtualMachines

az resource delete \
  --resource-group ExampleResourceGroup \
  --name ExampleVM \
  --resource-type "Microsoft.Compute/virtualMachines"

import os
from azure.identity import AzureCliCredential
from azure.mgmt.resource import ResourceManagementClient

credential = AzureCliCredential()
subscription_id = os.environ["AZURE_SUBSCRIPTION_ID"]

resource_client = ResourceManagementClient(credential, subscription_id)

resource_client.resources.begin_delete_by_id(
    "/subscriptions/{}/resourceGroups/{}/providers/{}/{}".format(
        subscription_id,
        "exampleGroup",
        "Microsoft.Compute",
        "virtualMachines/exampleVM"
    ),
    "2022-11-01"
)

Required access and deletion failures

To delete a resource group, you need access to the delete action for the Microsoft.Resources/subscriptions/resourceGroups resource.

Important

The only permission required to delete a resource group is permission to the delete action for deleting resource groups. You do not need permission to delete individual resources within that resource group. Additionally, delete actions that are specified in notActions for a roleAssignment are superseded by the resource group delete action. This is consistent with the scope hierarchy in the Azure role-based access control model.

For a list of operations, see Azure resource provider operations. For a list of built-in roles, see Azure built-in roles.

If you have the required access, but the delete request fails, it may be because there's a lock on the resources or resource group. Even if you didn't manually lock a resource group, a related service may have automatically locked it. Or, the deletion can fail if the resources are connected to resources in other resource groups that aren't being deleted. For example, you can't delete a virtual network with subnets that are still in use by a virtual machine.

Can I recover a deleted resource group?

No, you can't recover a deleted resource group. However, you might be able to restore some recently deleted resources.

Some resource types support soft delete. You might have to configure soft delete before you can use it. For information about enabling soft delete, see:

To restore deleted resources, see:

You can also open an Azure support case. Provide as much detail as you can about the deleted resources, including their resource IDs, types, and resource names. Request that the support engineer check if the resources can be restored.

Note

Recovery of deleted resources is not possible under all circumstances. A support engineer will investigate your scenario and advise you whether it's possible.

Next steps

To understand Resource Manager concepts, see Azure Resource Manager overview.
For deletion commands, see PowerShell, Azure CLI, and REST API.

Share via