Unable to unregister resource from Recovery services vault

Hello @syed

Please try above suggested workaround and let me know if it is helpfull?

Thanks,
Suchitra.

I have stopped backup for the VMs and DB (see screenshots). However I am unable to remove the soft-delete state. I get this error

az backup vault backup-properties set --name vault900 --resource-group RyznRG --soft-delete-feature-state Disable
--backup-storage-redundancy, --cross-region-restore-flag, --classic-alerts and --azure-monitor-alerts-for-job-failures parameters will be ignored if provided.
(BMSUserErrorDisablingSoftDeleteStateNotAllowed) Disabling soft delete or enhanced security state is not allowed for this vault. Please contact Microsoft Support if this is not expected.
Code: BMSUserErrorDisablingSoftDeleteStateNotAllowed
Message: Disabling soft delete or enhanced security state is not allowed for this vault. Please contact Microsoft Support if this is not expected.

What would be my next steps?

Hello @syed

Thanks for sharing us the screenshots:

You have correctly Stopped backup for all Azure VMs and SQL databases, Initiated Delete backup data, Identified that all items are in Soft‑Deleted state (isScheduledForDeferredDelete = true) and Confirmed Soft Delete + Enhanced Security are enabled

When you attempt to disable soft delete using:

az backup vault backup-properties set </span>
  --name vault900 </span>
  --resource-group RyznRG </span>
  --soft-delete-feature-state Disable

You are receiving error BMSUserErrorDisablingSoftDeleteStateNotAllowed Disabling soft delete or enhanced security state is not allowed for this vault.

This behavior is expected and by design.

Because Enhanced Security is enabled on the Recovery Services vault, Soft Delete becomes non‑disablable. When this combination is enabled:

• Soft Delete cannot be turned off
• Soft‑deleted backup items cannot be force‑purged by the customer
• Unregistering AzureWorkload (SQL in VM) containers is blocked until soft‑delete retention expires

This is exactly why:

• You cannot remove the soft‑delete state
• Unregister fails with a generic internal error
• CLI and portal both fail consistently

When enhanced security is enabled, soft delete cannot be disabled.

Reference: https://learn.microsoft.com/azure/backup/backup-azure-security-feature-cloud

For your scenario Soft Delete is enabled, Enhanced Security is enabled and Backup items are already soft‑deleted

So there is no supported self‑service way to immediately purge the data or unregister the workload container.

As a resolution Wait for the 14‑day soft‑delete retention period to expire and Items will be automatically purged

After purge your AzureWorkload container unregister succeeds, VM / RG migration succeeds and Vault cleanup succeeds.

Thanks,

Suchitra.

Hello @syed No additional charges are applied while Azure Backup items are in the 14‑day soft‑deleted state. Microsoft explicitly states that soft‑deleted backup data in a Recovery Services vault is retained free of cost. You can safely wait for the retention period to expire.

Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.

Unfortunately, I cannot wait for 14 days. We need to do a migration to a new subscription and I cannot have no backups for 14 days. That is extremely risky. Is there a way to force-delete and free the resources so that I can move subsriptions?