Not able to delete maintenance configurations from azure

Anton Bergman 0

Hi!

I've deployed multiple maintenance configurations with dynamic scopes that target subscriptions and looks for a specific tag on VMs. When i try to delete these maintenance configurations i simply get this error:

User's image

If i try to instead remove it by using powershell i get:

User's image

My user is owner on tenant root and global admin, and if i create a new maintenance configuration I'm able to delete it fine. So it shouldn't be a permission error.

I've deleted the dynamic scopes from the maintenance configurations and I've also removed all patch related tags from virtual machines, but something is still preventing me from deleting it.

Is there some other dependencies that I could remove that might be causing this issue?

I'm not able to find much help googling this as no one seems to be experiencing the same issues that I do.

Thankful for any advice!

Matan Elkobi 5 Reputation points

2025-03-02T12:43:34.1833333+00:00
@Anton Bergman

Check If the Maintenance Configuration is Still Assigned to a Resource

Even though you removed dynamic scopes and tags, the maintenance configuration could still be assigned to a VM or another resource type. You can verify this by running:

powershell CopyEdit Get-AzMaintenanceConfiguration -ResourceGroupName "YourResourceGroup"

Then, check if the Scope property still contains any resource assignments.

If you see any, try unassigning the maintenance configuration explicitly:

powershell CopyEdit Remove-AzMaintenanceConfigurationAssignment -MaintenanceConfigurationName "YourMaintenanceConfig"

Check for Policies That Reference the Maintenance Configuration

If there’s an Azure Policy enforcing specific patch configurations, it could be preventing deletion.

Run the following command to check policies related to maintenance:

powershell CopyEdit Get-AzPolicyAssignment | Where-Object { $_.Properties.policyDefinitionId -like "*maintenance*" }

If you find any relevant policies, remove them:

powershell CopyEdit Remove-AzPolicyAssignment -Id "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/{policyAssignmentId}"

Force Delete Using Azure REST API

Sometimes, resources get "stuck" in Azure. The REST API can bypass UI and PowerShell limitations.

Try the following using Azure CLI:

bash CopyEdit az rest --method DELETE --uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Maintenance/maintenanceConfigurations/{configName}?api-version=2023-04-01"

Replace {subscriptionId}, {resourceGroupName}, and {configName} with actual values.

Check Activity Logs for Additional Clues

Go to Azure Portal → Monitor → Activity Log and filter for “Delete” operations related to the maintenance configuration. If there's an explicit error message or dependency listed, it might help pinpoint the cause.

Remove Role Assignments Related to the Maintenance Configuration

If a Managed Identity or Service Principal has a role assignment related to the maintenance configuration, it might prevent deletion. Run:

powershell CopyEdit Get-AzRoleAssignment | Where-Object { $_.Scope -like "*Maintenance*" }

If you find relevant assignments, remove them:

powershell CopyEdit Remove-AzRoleAssignment -ObjectId "xxxx-xxxx-xxxx" -RoleDefinitionName "Contributor"

Check for Locks on the Resource

If the maintenance configuration has a resource lock, it will prevent deletion.

List all locks in the subscription:

powershell CopyEdit Get-AzResourceLock

If you find a lock associated with your maintenance configuration, remove it:

powershell CopyEdit Remove-AzResourceLock -LockId "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Maintenance/maintenanceConfigurations/{configName}/providers/Microsoft.Authorization/locks/{lockName}"

Wait and Retry

Azure sometimes has propagation delays when removing dependencies (such as policies, role assignments, or scope changes). If you recently removed dependencies, waiting 10–15 minutes and then retrying might help.

Final Steps

If none of the above solutions work:

Try using Azure Support: Open a support ticket under "Management and Governance > Maintenance Configurations".

If you're dealing with a bug, consider exporting the maintenance configuration (Get-AzMaintenanceConfiguration | ConvertTo-Json) and providing that when requesting support.

Let me know if any of these steps work for you! 🚀
Anton Bergman 0 Reputation points

2025-03-03T11:57:23.4033333+00:00

Thank you Matan Elkobi!

running az rest --method DELETE --uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Maintenance/maintenanceConfigurations/{configName}?api-version=2023-04-01" finally gave me an error message that tells me what is preventing deletion.

It was a deploymentstack deny assignment that covered the same scope as my deployment that caused it. I was under the impression that deploymentstack deny assignments only covered resources deployed by that deploymentstack, but it seems that is not the case.

Once again, big thanks for you assistance!

Share via

Not able to delete maintenance configurations from azure

Your answer