Delete an Azure Backup Recovery Services vault

This article describes how to delete an Azure Backup Recovery Services vault. It contains instructions for removing dependencies and then deleting a vault.

Before you start

You can't delete a Recovery Services vault with any of the following dependencies:

  • You can't delete a vault that contains protected data sources (for example, IaaS VMs, SQL databases, Azure file shares).
  • You can't delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted state.
  • You can't delete a vault that contains backup data in the soft deleted state.
  • You can't delete a vault that has registered storage accounts.

If you try to delete the vault without removing the dependencies, you'll encounter one of the following error messages:

  • Vault cannot be deleted as there are existing resources within the vault. Please ensure there are no backup items, protected servers, or backup management servers associated with this vault. Unregister the following containers associated with this vault before proceeding for deletion.

  • Recovery Services vault cannot be deleted as there are backup items in soft deleted state in the vault. The soft deleted items are permanently deleted after 14 days of delete operation. Please try vault deletion after the backup items are permanently deleted and there is no item in soft deleted state left in the vault. For more information, see Soft delete for Azure Backup.

Note

Before deleting a Backup protection policy from a vault, you must ensure that

  • the policy doesn't have any associated Backup items.
  • each associated item is associated with some other policy.

Delete a Recovery Services vault

Choose a client:

First, read the Before you start section to understand the dependencies and vault deletion process.

Note

  • To download the PowerShell file to delete your vault, go to vault Overview -> Delete -> Delete using PowerShell Script, and then click Generate and Download Script as shown in the screenshot below. This generates a customized script specific to the vault, which requires no additional changes. You can run the script in the PowerShell console by switching to the downloaded script’s directory and running the file using: .\NameofFile.ps1
  • Ensure PowerShell version 7 or higher is installed. To install the same, see the instructions here.

If you're sure that all the items backed up in the vault are no longer required and wish to delete them at once without reviewing, you can directly run the PowerShell script in this section. The script will delete all the backup items recursively and eventually the entire vault.

Screenshot showing the process to generate the delete vault PowerShell script.

Follow these steps:

  • Step 1: Seek the necessary permissions from the security administrator to delete the vault if Multi-User Authorization has been enabled against the vault. Learn more

  • Step 2: Upgrade to PowerShell 7 version by performing these steps:

    1. Upgrade to PowerShell 7: Run the following command in your console:

      iex "& { $(irm https://aka.ms/install-powershell.ps1) } -UseMSI"
      
    2. Open PowerShell 7 as administrator.

  • Step 3: Save the PowerShell script in .ps1 format. Then, to run the script in your PowerShell console, type ./NameOfFile.ps1. This recursively deletes all backup items and eventually the entire Recovery Services vault.

    Note

    To access the PowerShell script for vault deletion, see the PowerShell script for vault deletion article.

    Run the script in the PowerShell console

    This script performs the following actions:

    1. Disable soft delete and security features
    2. Delete backup items
    3. Unregister servers and storage accounts
    4. Delete Disaster Recovery items
    5. Remove private endpoints

To delete an individual backup items or write your own script, use the following PowerShell commands:

  • Stop protection and delete the backup data:

    If you're using SQL in Azure VMs backup and enabled autoprotection for SQL instances, first disable the autoprotection.

        Disable-AzRecoveryServicesBackupAutoProtection
           [-InputItem] <ProtectableItemBase>
           [-BackupManagementType] <BackupManagementType>
           [-WorkloadType] <WorkloadType>
           [-PassThru]
           [-VaultId <String>]
           [-DefaultProfile <IAzureContextContainer>]
           [-WhatIf]
           [-Confirm]
           [<CommonParameters>]
    

    Learn more on how to disable protection for an Azure Backup-protected item.

  • Stop protection and delete data for all backup-protected items in cloud (for example, IaaS VM, Azure file share, and so on):

       Disable-AzRecoveryServicesBackupProtection
       [-Item] <ItemBase>
       [-RemoveRecoveryPoints]
       [-Force]
       [-VaultId <String>]
       [-DefaultProfile <IAzureContextContainer>]
       [-WhatIf]
       [-Confirm]
       [<CommonParameters>]
    

    Learn more about disabling protection for a Backup-protected item.

After deleting the backed-up data, unregister any on-premises containers and management servers.

  • For on-premises Files and Folders protected using Azure Backup Agent (MARS) backing up to Azure:

    Unregister-AzRecoveryServicesBackupContainer
              [-Container] <ContainerBase>
              [-PassThru]
              [-VaultId <String>]
              [-DefaultProfile <IAzureContextContainer>]
              [-WhatIf]
              [-Confirm]
              [<CommonParameters>]
    

    Learn more about unregistering a Windows Server or other container from the vault.

  • For on-premises machines protected using MABS (Microsoft Azure Backup Server) or DPM to Azure (System Center Data Protection Manage:

        Unregister-AzRecoveryServicesBackupManagementServer
          [-AzureRmBackupManagementServer] <BackupEngineBase>
          [-PassThru]
          [-VaultId <String>]
          [-DefaultProfile <IAzureContextContainer>]
          [-WhatIf]
          [-Confirm]
          [<CommonParameters>]
    

    Learn more about unregistering a Backup management container from the vault.

After permanently deleting backed up data and unregistering all containers, proceed to delete the vault.

To delete a Recovery Services vault:

    Remove-AzRecoveryServicesVault
   -Vault <ARSVault>
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Learn more about deleting a Recovery Services vault.

Next steps