Delete an Azure Backup Recovery Services vault

To delete a vault, follow these steps:

• Step 1: Go to vault Overview, click Delete, and then follow the instructions to complete the removal of Azure Backup and Azure Site Recovery items for vault deletion as shown below. Each link calls the respective blade to perform the corresponding vault deletion steps.

  See the instructions in the following steps to understand the process. Also, you can go to each blade to delete vaults.

  

  Alternately, go to the blades manually by following the steps below.

• Step 2: If Multi-User Authorization (MUA) is enabled, seek necessary permissions from the security administrator before vault deletion. Learn more

• Step 3: Disable the soft delete and Security features

  1. Go to Properties -> Security Settings and disable the Soft Delete feature if enabled. See how to disable soft delete.
  2. Go to Properties -> Security Settings and disable Security Features, if enabled. Learn more

• Step 4: Delete Cloud protected items

  1. Delete Items in soft-deleted state: After disabling soft delete, check if there are any items previously remaining in the soft deleted state. If there are items in soft deleted state, then you need to undelete and delete them again. Follow these steps to find soft delete items and permanently delete them.

     

  2. Go to the vault dashboard menu -> Backup Items. Click Stop Backup to stop the backups of all listed items, and then click Delete Backup Data to delete. Follow these steps to remove those items.

  Note

  You don't need to delete Virtual Machine or policy, you only need to stop backup to the vault.

• Step 5: Delete Backup Servers

  1. Go to the vault dashboard menu > Backup Infrastructure > Protected Servers. In Protected Servers, select the server to unregister. To delete the vault, you must unregister all the servers. Right-click each protected server and select Unregister.

  2. MARS protected servers: Go to the vault dashboard menu -> Backup Infrastructure -> Protected Servers. If you've MARS protected servers, then all servers listed here must be deleted along with their backup data. Follow these steps to delete MARS protected servers.

  3. MABS or DPM management servers: Go to the vault dashboard menu > Backup Infrastructure > Backup Management Servers. If you've DPM or Azure Backup Server (MABS), then all items listed here must be deleted or unregistered along with their backup data. Follow these steps to delete the management servers.

  Note

  Deleting MARS/MABS/DPM servers also removes the corresponding backup items protected in the vault.

• Step 6: Unregister Storage Accounts

  Ensure all registered storage accounts are unregistered for successful vault deletion. Go to the vault dashboard menu > Backup Infrastructure > Storage Accounts. If you've storage accounts listed here, then you must unregister all of them. Learn more how to Unregister a storage account.

• Step 7: Remove Private Endpoints

  Ensure there are no Private endpoints created for the vault. Go to Vault dashboard menu > Private endpoint Connections under 'Settings' > if the vault has any Private endpoint connections created or attempted to be created, ensure they are removed before proceeding with vault delete.

• Step 8: Delete vault

  After you've completed these steps, you can continue to delete the vault.

  If you're still unable to delete the vault that contain no dependencies then follow the steps listed in deleting vault using Azure Resource Manager client.

First, read the Before you start section to understand the dependencies and vault deletion process.

To stop protection and delete the backup data, perform the following steps:

1. From the portal, go to Recovery Services vault, and then go to Backup items. Then, in the Backup Management Type list, select the protected items in the cloud (for example, Azure Virtual Machines, Azure Storage (the Azure Files), or SQL Server on Azure Virtual Machines).

   

2. You'll see a list of all the items for the category. Right-click to select the backup item. Depending on whether the backup item is protected or not, the menu displays either the Stop Backup pane or the Delete Backup Data pane.

   • If the Stop Backup pane appears, select Delete Backup Data from the drop-down menu. Enter the name of the backup item (this field is case-sensitive), and then select a reason from the drop-down menu. Enter your comments, if you've any. Then, select Stop backup.

     

   • If the Delete Backup Data pane appears, enter the name of the backup item (this field is case-sensitive), and then select a reason from the drop-down menu. Enter your comments, if you've any. Then, select Delete.

     

   This option deletes scheduled backups, also deletes on-demand backups.

3. Check the Notification icon: After the process finishes, the service displays the following message: Stopping backup and deleting backup data for "Backup Item". Successfully completed the operation.

4. Select Refresh on the Backup Items menu, to make sure the backup item was deleted.

   

First, read the Before you start section to understand the dependencies and vault deletion process.

1. From the vault dashboard menu, select Backup Infrastructure.

2. Depending on your on-premises scenario, choose the one of the following options:

   • For MARS, select Protected Servers and then Azure Backup Agent. Then, select the server that you want to delete.

     

   • For MABS or DPM, select Backup Management Servers. Then, select the server that you want to delete.

     

3. The Delete pane appears with a warning message.

   

   Review the warning message and the instructions in the consent check box.

   Note

   • If the protected server is synced with Azure services and backup items exist, the consent check box will display the number of dependent backup items and the link to view the backup items.
   • If the protected server isn't synced with Azure services and backup items exist, the consent check box will display only the number of backup items.
   • If there're no backup items, the consent check box will ask for deletion.

4. Select the consent check box, and then select Delete.

5. Check the Notification icon . After the operation finishes, the service displays the message: Stopping backup and deleting backup data for "Backup Item." Successfully completed the operation.

6. Select Refresh on the Backup Items menu, to make sure the backup item is deleted.

After this process finishes, you can delete the backup items from management console:

• Delete backup items from the MARS management console
• Delete backup items from the MABS or DPM management console

1. Open the MARS management console, go to the Actions pane, and select Schedule Backup.

2. From the Modify or Stop a Scheduled Backup page, select Stop using this backup schedule and delete all the stored backups. Then, select Next.

   

3. From the Stop a Scheduled Backup page, select Finish.

   

4. You're prompted to enter a security PIN (personal identification number), which you must generate manually. To do this, first sign in to the Azure portal.

5. Go to Recovery Services vault > Settings > Properties.

6. Under Security PIN, select Generate. Copy this PIN. The PIN is valid for only five minutes.

7. In the management console, paste the PIN, and then select OK.

   

8. In the Modify Backup Progress page, the following message appears: Deleted backup data will be retained for 14 days. After that time, backup data will be permanently deleted.

   

After you delete the on-premises backup items, follow the next steps from the portal.

There are two methods you can use to delete backup items from the MABS or DPM management console.

To stop protection and delete backup data, do the following steps:

1. Open the DPM Administrator Console, and then select Protection on the navigation bar.

2. In the display pane, select the protection group member that you want to remove. Right-click to select the Stop Protection of Group Members option.

3. From the Stop Protection dialog box, select Delete protected data, and then select the Delete storage online check box. Then, select Stop Protection.

   

   For the following versions, you're prompted to enter a security PIN (personal identification number), which you must generate manually.

   • DPM 2019 UR1 and later
   • DPM 2016 UR9 and later
   • MABS V3 UR1 and later

   To generate the PIN, do the following steps:

   1. Sign in to the Azure portal.
   2. Go to Recovery Services vault > Settings > Properties.
   3. Under Security PIN, select Generate.
   4. Copy this PIN.

      Note

      The PIN is valid for only five minutes.

   5. In the management console, paste the PIN, and then select Submit.

4. If you had selected Delete storage online in the Stop Protection dialog box earlier, ignore this step. Right-click the inactive protection group and select Remove inactive protection.

   

5. From the Delete Inactive Protection window, select the Delete online storage check box, and then select OK.

   

   For the following versions, you're prompted to enter a security PIN (personal identification number), which you must generate manually.

   • DPM 2019 UR1 and later
   • DPM 2016 UR9 and later
   • MABS V3 UR1 and later

   To generate the PIN, do the following steps:

   1. Sign in to the Azure portal.
   2. Go to Recovery Services vault > Settings > Properties.
   3. Under Security PIN, select Generate.
   4. Copy this PIN.

      Note

      The PIN is valid for only five minutes.

   5. In the management console, paste the PIN, and then select Submit.

   The protected member status changes to Inactive replica available.

Open the MABS management or DPM management console. Under Select data protection method, clear the I want online protection check box.

After you delete the on-premises backup items, follow the next steps from the portal.

1. When all dependencies have been removed, scroll to the Essentials pane in the vault menu.

2. Verify that there aren't any backup items, backup management servers, or replicated items listed. If items still appear in the vault, refer to the Before you start section.

3. When there are no more items in the vault, select Delete on the vault dashboard.

   

4. Select Yes to verify that you want to delete the vault. The vault is deleted. The portal returns to the New service menu.

First, read the Before you start section to understand the dependencies and vault deletion process.

If you're sure that all the items backed up in the vault are no longer required and wish to delete them at once without reviewing, you can directly run the PowerShell script in this section. The script will delete all the backup items recursively and eventually the entire vault.

Follow these steps:

• Step 1: Seek the necessary permissions from the security administrator to delete the vault if Multi-User Authorization has been enabled against the vault. Learn more

• Step 2: Upgrade to PowerShell 7 version by performing these steps:

  1. Upgrade to PowerShell 7: Run the following command in your console:

     iex "& { $(irm https://aka.ms/install-powershell.ps1) } -UseMSI"
     

  2. Open PowerShell 7 as administrator.

• Step 3: Save the PowerShell script in .ps1 format. Then, to run the script in your PowerShell console, type ./NameOfFile.ps1. This recursively deletes all backup items and eventually the entire Recovery Services vault.

  Note

  To access the PowerShell script for vault deletion, see the PowerShell script for vault deletion article.

  Run the script in the PowerShell console

  This script performs the following actions:

  1. Disable soft delete and security features
  2. Delete backup items
  3. Unregister servers and storage accounts
  4. Delete Disaster Recovery items
  5. Remove private endpoints

To delete an individual backup items or write your own script, use the following PowerShell commands:

• Stop protection and delete the backup data:

  If you're using SQL in Azure VMs backup and enabled autoprotection for SQL instances, first disable the autoprotection.

      Disable-AzRecoveryServicesBackupAutoProtection
         [-InputItem] <ProtectableItemBase>
         [-BackupManagementType] <BackupManagementType>
         [-WorkloadType] <WorkloadType>
         [-PassThru]
         [-VaultId <String>]
         [-DefaultProfile <IAzureContextContainer>]
         [-WhatIf]
         [-Confirm]
         [<CommonParameters>]
  

  Learn more on how to disable protection for an Azure Backup-protected item.

• Stop protection and delete data for all backup-protected items in cloud (for example, IaaS VM, Azure file share, and so on):

     Disable-AzRecoveryServicesBackupProtection
     [-Item] <ItemBase>
     [-RemoveRecoveryPoints]
     [-Force]
     [-VaultId <String>]
     [-DefaultProfile <IAzureContextContainer>]
     [-WhatIf]
     [-Confirm]
     [<CommonParameters>]
  

  Learn more about disabling protection for a Backup-protected item.

After deleting the backed-up data, unregister any on-premises containers and management servers.

• For on-premises Files and Folders protected using Azure Backup Agent (MARS) backing up to Azure:

  Unregister-AzRecoveryServicesBackupContainer
            [-Container] <ContainerBase>
            [-PassThru]
            [-VaultId <String>]
            [-DefaultProfile <IAzureContextContainer>]
            [-WhatIf]
            [-Confirm]
            [<CommonParameters>]
  

  Learn more about unregistering a Windows Server or other container from the vault.

• For on-premises machines protected using MABS (Microsoft Azure Backup Server) or DPM to Azure (System Center Data Protection Manage:

      Unregister-AzRecoveryServicesBackupManagementServer
        [-AzureRmBackupManagementServer] <BackupEngineBase>
        [-PassThru]
        [-VaultId <String>]
        [-DefaultProfile <IAzureContextContainer>]
        [-WhatIf]
        [-Confirm]
        [<CommonParameters>]
  

  Learn more about unregistering a Backup management container from the vault.

After permanently deleting backed up data and unregistering all containers, proceed to delete the vault.

To delete a Recovery Services vault:

    Remove-AzRecoveryServicesVault
   -Vault <ARSVault>
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Learn more about deleting a Recovery Services vault.

First, read the Before you start section to understand the dependencies and vault deletion process.

To delete existing Recovery Services vault, perform the following steps:

• To stop protection and delete the backup data

  az backup protection disable --container-name
                           --item-name
                           [--delete-backup-data {false, true}]
                           [--ids]
                           [--resource-group]
                           [--subscription]
                           [--vault-name]
                           [--yes]
  

  For more information, see this article.

• Delete an existing Recovery Services vault:

  az backup vault delete [--force]
                     [--ids]
                     [--name]
                     [--resource-group]
                     [--subscription]
                     [--yes]
  

  For more information, see this article

Delete the Recovery Services vault using Azure Resource Manager is recommended only if all of the dependencies are removed and you're still getting the Vault deletion error. Try any or all of the following tips:

• From the Essentials pane in the vault menu, verify that there aren't any backup items, backup management servers, or replicated items listed. If there are backup items, refer to the Before you start section.
• Try deleting the vault from the portal again.
• If all of the dependencies are removed and you're still getting the Vault deletion error, use the ARMClient tool to perform the following steps (after the note).

1. Go to chocolatey.org to download and install Chocolatey. Then, install ARMClient by running the following command:

   choco install armclient --source=https://chocolatey.org/api/v2/

2. Sign in to your Azure account, and then run the following command:

   ARMClient.exe login [environment name]

3. In the Azure portal, gather the subscription ID and resource group name for the vault you want to delete.

For more information on the ARMClient command, see ARMClient README.

1. Run the following command by using your subscription ID, resource group name, and vault name. If you don't have any dependencies, the vault is deleted when you run the following command:

   ARMClient.exe delete /subscriptions/<subscriptionID>/resourceGroups/<resourcegroupname>/providers/Microsoft.RecoveryServices/vaults/<Recovery Services vault name>?api-version=2015-03-15
   

2. If the vault isn't empty, you'll receive the following error message: Vault cannot be deleted as there are existing resources within this vault. To remove a protected item or container within a vault, run the following command:

   ARMClient.exe delete /subscriptions/<subscriptionID>/resourceGroups/<resourcegroupname>/providers/Microsoft.RecoveryServices/vaults/<Recovery Services vault name>/registeredIdentities/<container name>?api-version=2016-06-01
   

3. In the Azure portal, make sure that the vault is deleted.