Azure Resource Manager resource group and resource deletion

This article shows how to delete resource groups and resources. It describes how Azure Resource Manager orders the deletion of resources when you delete a resource group. Note To delete a resource group, you must first remove any underlying resource locks and backup data. How Resource Manager determ

This article shows how to delete resource groups and resources. It describes how Azure Resource Manager orders the deletion of resources when you delete a resource group.

Note

To delete a resource group, you must first remove any underlying resource locks and backup data.

How Resource Manager determines the order of deletion

When you delete a resource group, Resource Manager determines the order to delete resources. It uses the following order:

All the child (nested) resources are deleted.
Resources that manage other resources are deleted next. A resource can have the managedBy property set to indicate that a different resource manages it. When this property is set, the resource that manages the other resource is deleted before the other resources.
The remaining resources are deleted after the previous two categories.

After Resource Manager determines the order, it issues a DELETE operation for each resource. It waits for any dependencies to finish before proceeding.

For synchronous operations, the expected successful response codes are:

For asynchronous operations, the expected successful response is 202. Resource Manager tracks the location header or the azure-async operation header to determine the status of the asynchronous delete operation.

Deletion errors

When a delete operation returns an error, Resource Manager retries the DELETE call. Retries happen for the 5xx, 429, and 408 status codes. By default, the time period for retry is 15 minutes.

After deletion

Resource Manager issues a GET call on each resource that it tried to delete. The response of this GET call is expected to be 404. When Resource Manager gets a 404, it considers the deletion to be successful. Resource Manager removes the resource from its cache.

However, if the GET call on the resource returns a 200 or 201, Resource Manager recreates the resource.

If the GET operation returns an error, Resource Manager retries the GET for the following error codes:

Less than 100
408
429
Greater than 500

For other error codes, Resource Manager fails the deletion of the resource.

Important

Resource group deletion is irreversible.

Delete resource group

To delete the resource group, use one of the following methods.

Remove-AzResourceGroup -Name ExampleResourceGroup

az group delete --name ExampleResourceGroup

In the portal, select the resource group you want to delete.
Select Delete resource group.

Open diagram: Screenshot of the 'Delete resource group' button in the Azure portal.
To confirm the deletion, type the name of the resource group.

import os
from azure.identity import AzureCliCredential
from azure.mgmt.resource import ResourceManagementClient

credential = AzureCliCredential()
subscription_id = os.environ["AZURE_SUBSCRIPTION_ID"]

resource_client = ResourceManagementClient(credential, subscription_id)

rg_result = resource_client.resource_groups.begin_delete("exampleGroup")

Delete resource

To delete a resource, use one of the following methods.

Remove-AzResource `
  -ResourceGroupName ExampleResourceGroup `
  -ResourceName ExampleVM `
  -ResourceType Microsoft.Compute/virtualMachines

az resource delete \
  --resource-group ExampleResourceGroup \
  --name ExampleVM \
  --resource-type "Microsoft.Compute/virtualMachines"

In the portal, select the resource you want to delete.
Select Delete. The following screenshot shows the management options for a virtual machine.

Open diagram: Screenshot of the Delete button for a virtual machine in the Azure portal.
When prompted, confirm the deletion.

import os
from azure.identity import AzureCliCredential
from azure.mgmt.resource import ResourceManagementClient

credential = AzureCliCredential()
subscription_id = os.environ["AZURE_SUBSCRIPTION_ID"]

resource_client = ResourceManagementClient(credential, subscription_id)

resource_client.resources.begin_delete_by_id(
    "/subscriptions/{}/resourceGroups/{}/providers/{}/{}".format(
        subscription_id,
        "exampleGroup",
        "Microsoft.Compute",
        "virtualMachines/exampleVM"
    ),
    "2022-11-01"
)

Required access and deletion failures

To delete a resource group, you need access to the delete action for the Microsoft.Resources/subscriptions/resourceGroups resource.

Important

The only permission required to delete a resource group is permission to the delete action for deleting resource groups. You don't need permission to delete individual resources within that resource group. Additionally, delete actions that are specified in notActions for a roleAssignment are superseded by the resource group delete action. This requirement is consistent with the scope hierarchy in the Azure role-based access control model.

For a list of operations, see Azure resource provider operations. For a list of built-in roles, see Azure built-in roles.

If you have the required access, but the delete request fails, it might be because there's a lock on the resources or resource group. Even if you didn't manually lock a resource group, a related service might automatically lock it. Or, the deletion can fail if the resources are connected to resources in other resource groups that aren't being deleted. For example, you can't delete a virtual network with subnets that a virtual machine uses.

Can I recover a deleted resource group?

No, you can't recover a deleted resource group. However, you might be able to restore some recently deleted resources.

Some resource types support soft delete. You might have to configure soft delete before you can use it. For information about enabling soft delete, see:

To restore deleted resources, see:

You can also open an Azure support case. Provide as much detail as you can about the deleted resources, including their resource IDs, types, and resource names. Request that the support engineer check if the resources can be restored.