Deleting Azure Active Directory
If you’re like me, and I know I am, you have probably signed up for several Microsoft Online Services trials or just somehow ended up with multiple Azure AD instances associated with your Microsoft Azure subscription. Turns out they’re kind of hard to delete, but it’s not impossible. Here’s how.
Just because you don’t want the Azure AD instance around anymore doesn’t necessarily mean that your Azure subscription hasn’t become attached. If you try to just hit the delete button on your Azure AD instance, you’ll probably get something like this in return:
So, as you can see, there’s some work to be done. Here’s how to kill off each of those without getting carpal tunnel syndrome deleting hundreds of user accounts and applications one at a time.
The first thing you need to do is connect to your Azure subscription using PowerShell. That might sound scary to some, but it’s pretty simple to do. There are two ways to do it depending on whether you want to automate the connection or log in interactively (and not type your password in a plain text script).
Either way, if you haven’t done this before you will want to install the Microsoft Online Services Sign-In Assistant from (https://go.microsoft.com/fwlink/?LinkID=286152) and the Azure AD PowerShell module (https://go.microsoft.com/fwlink/p/?linkid=236297) before continuing.
Ready to go? OK, if you want to automate all of this as much as possible, you can authenticate to Azure like this below (the admin account is probably the <name> @mydomain.onmicrosoft.com account that you used when you first created your AAD):
$User="<admin account for the AAD you want to delete>"
$Password="<Password>"
$SecurePassword = $Password | ConvertTo-SecureString -AsPlainText -Force
$msolcred = New-Object –TypeName System.Management.Automation.PSCredential ($User,$SecurePassword)
connect-msolservice -credential $msolcred
OR, if you don’t want someone to see your password and want to log in interactively, do this instead:
$msolcred = get-credential
connect-msolservice -credential $msolcred
Freshly authenticated, at the top of the list of offending items stopping you from deleting your Azure AD is users.
Yep, there they are. Hundreds of them. Let’s delete them.
You can only delete an Azure AD directory if you, the AAD admin, are the only user associated with it. After connecting to Azure with PowerShell, you can get a list of all users by running this command (choose the path and file name of your liking):
Get-MsolUser –All | Export-CSV C:\temp\users.csv
Bonus Tip: you can get groups like this too, but technically you don’t have to delete them to delete your Azure AD: Get-MsolGroup –All | Export-CSV C:\temp\groups.csv.
Open the recently exported users.csv file and look in the SignInName column (column AO in my exported .csv) to find the AAD admin account you're logged in as (probably something like admin@mydomainname.onmicrosoft.com). Delete that row to remove the user account (you) from the file and save it. Now that every user (except you) is listed in that .csv file, it’s time to import the file and delete everyone.
Say any final words you feel are appropriate and then run this command to recycle user account electrons:
Import-CSV C:\temp\users.csv | Remove-MsOlUser –Force
Bonus Tip #2: You can whack Azure AD groups like this too, but again, it’s not necessary to delete your AAD instance: Import-CSV C:\groups.csv | Remove-MsOlGroup –Force.
Altogether, it looks something like this:
Go grab a snack because it might be a few minutes depending on how many users you need to send to oblivion. After a bit, only the admin account you’re using to delete the directory should be present.
All users besides you gone? Check.
Next on my hit list are the enterprise applications. Back in PowerShell, you need to run a few different commands. To see the list of applications blocking you from deleting your AAD instance, run this command:
Get-MsolServicePrincipal | Select Displayname
Some of the returned app names are required and can stay, but others, the ones users have added, have to go. Time to say good-bye:
Get-MsolServicePrincipal | Remove-MsolServicePrincipal
Haha you say, my screen is full of red errors! I know, I know, just ignore those and run that first command again to see who’s left…those are the ones you don’t have to (read: can’t) delete this way. See?
With enterprise applications gone, there's just one last thing blocking us from deleting this Azure AD instance: active Microsoft Online Services subscriptions.
If you’ve only got Azure AD to delete, then you probably already have one of those coveted check marks and can just click Delete now and be done.
Me on the other hand, I’ve got this Azure AD instance intertwined with an Enterprise Mobility + Security E3 subscription…AKA another Microsoft Online Services subscription (could just as easily be Intune, Office 365, or Azure AD Premium). So, I can’t delete the Azure AD instance until the EMS subscription is taken care. Let’s go do that.
There are two ways to do delete a license-based subscription like Azure Active Directory Premium P1, P2, Office 365 Business, or Enterprise + Mobility Suite E3 and E5 (pay-as-you go subscriptions can only be deleted from the Azure portal). If you’re not in a hurry, or just want to learn more about what happens in the background when you delete a subscription, follow this next section to get your subscription deleted in about 90 days. If you’re in a rush, skip to the section at the bottom and say good-bye to your subscription in about 3 days.
Cancel and delete a subscription
If you have time on your hands and don't mind waiting 90 days to delete a license-based subscription, just sign in to the Office 365 portal (portal.office.com), and then go to Billing > Subscriptions. Under the “More actions” drop-down, select Cancel (or cancel trial in my case):
This will set your subscription to Disabled not deleted. You can’t delete it because subscriptions have a life cycle of their own. That’s OK though as once you remove your Microsoft Account from the directory you won’t see it in your Azure subscription's Azure AD directories list again unless you log in with the admin account you deleted everything with within 90 days of disabling the subscription.
When the subscription is deprovisioned (90 days from when you cancelled it), the Azure AD instance associated with it will also automatically be history.
Delete a subscription
Why do I have the feeling everyone jumped to here when I said you can delete a license-based subscription in only 3 days instead of 90? Anyway, for those of you in a hurry to delete a subscription, you can now use the Microsoft Store for Business portal (this capability is also coming soon to Office 365 Admin center) to quickly deprovision a subscription so that you'll be able to delete your Azure AD from the Azure portal about 72 hours later. Three days instead of 90? Sign me up! How do you do that you ask? Just follow these quick directions towards the bottom of this docs.microsoft.com article Delete an Azure Active Directory tenant.
Delete Azure AD. Done!
You’ve seen my blog; want to follow me on Twitter too? @JeffGilb.