Need to delete an immutable backup vault which is not used

Hello Jeff Powell

Thank you for posting your query on Microsoft Q&A platform.

As you can’t delete a Recovery Services vault because it’s protected by Azure Backup safeguards such as Soft Delete, Immutable vault, Resource Guard (MUA), or there are residual backup/ASR dependencies.

As a resolution follow below steps in order:

1. Verify what’s blocking deletion:

In the vault (Properties → Security/Immutable/MUA):

• Soft Delete: Vault can’t be deleted while any backup items are in soft‑deleted state (they auto‑purge after 14 days).
• Immutable vault: If immutability is enabled and locked, operations that could cause loss of recovery points (including delete‑backup‑data) are blocked until retention expires, deletion of the vault will only be possible after all items/windows have elapsed.
• Multi‑User Authorization (Resource Guard): Critical ops (e.g., disable soft delete, stop+delete backup data) may require the MUA approval/PIN.

Also check for resource locks and ASR infrastructure (fabrics/policies/replicated items).

2. Remove backup dependencies:

For each protected item (Azure VM, SQL/SAP HANA in VM, Azure Files, MARS/MABS/DPM):

• Stop backup and choose Delete backup data (preferred when the vault is being retired). This moves the item into soft‑deleted for 14 days (no charge). You cannot delete the vault until no items remain in soft‑deleted state.
• If policy allows and you must avoid the wait: Disable Soft Delete, then undelete + delete again to permanently remove right away (note: MUA may protect this operation).
• PowerShell reference for stopping protection and (optionally) removing recovery points: Disable‑AzRecoveryServicesBackupProtection -RemoveRecoveryPoints (older docs name this “Stop backup”). Reference: https://v4.hkg1.meaqua.org/en-us/powershell/module/az.recoveryservices/disable-azrecoveryservicesbackupprotection?view=azps-15.1.0&viewFallbackFrom=azps-14.3.0

3. Remove Azure Site Recovery (ASR) dependencies (if the vault was used for DR):

• Disable replication for every protected machine, then delete replication policies, fabrics, and other infrastructure.
• You can remove ASR fabrics via PowerShell/CLI/REST if needed.

4. Understand Immutable vault behavior (if enabled):

• Enabled: Restricted operations that could reduce retention or delete data are blocked.
• Locked (WORM): The setting is irreversible and backup data can’t be deleted before policy expiry, vault deletion is effectively blocked until all recovery points and windows expire.

5. When all items are gone (and any soft‑delete/immutability windows have elapsed): Delete the vault using Portal/PowerShell/CLI.

Example PowerShell cmdlet: Remove‑AzRecoveryServicesVault -Vault $vault

Thanks,

Suchitra.

Hello Jeff Powell

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

Thanks,

Suchitra.

Unfortunately, this did not work for us. Our backup vault is immutable and locked. Please see the attached screenshot of our backup policy: Backup_policy.png. We tried deleting the backup data, but it errors out, saying, "We have an active recovery point." Is there any way to delete these backups and vault? The resources being backed up do not exist now, and we see no reason to keep this vault for 10 years as per the backup policy.

Here is a screenshot of the error we are encountering: Error_when_deleting_backupdata.png

Hello Jeff Powell

Before deleting a Backup protection policy from a vault, you must ensure that the policy doesn't have any associated Backup items, each associated item is associated with some other policy.

Could you please share the below details?

• Are there any other backup items or dependencies currently associated with the vault?
• Have you confirmed that no soft deleted items are present?
• Are you currently using Multi-User Authorization (MUA)? This can sometimes add extra steps before you can delete a vault.

Thanks,

Suchitra.