Can't hard delete backup items in VM Recovery Vault, soft delete already disabled

Question

Can't hard delete backup items in VM Recovery Vault, soft delete already disabled

Kelly Michetti 0

From the support resources:

"The Recovery Services vault can't be deleted if there are backup items in soft-deleted state in the vault. The soft-deleted items are permanently deleted 14 days after the delete operation. If you can't wait for 14 days, then disable soft delete, undelete the soft deleted items, and delete them again to permanently get deleted."

I did all this but they are always soft-deleted no matter what I do. Soft delete IS DISABLED

Himanshu Shekhar 1,095 Reputation points Microsoft External Staff Moderator

2025-10-14T06:46:45.94+00:00

We are looking into the issue. Also reached with additional details via private messages
Bharath Y P 1,350 Reputation points Microsoft External Staff Moderator

2025-10-14T08:38:00.96+00:00
Hello Kelly Michetti,

From description you provided, we understand that you are trying to delete a Recovery Services vault in Azure, but it's blocked due to backup items stuck in a soft-deleted state. You've already disabled soft delete and followed the recommended steps, but the items still show as soft-deleted.

This is the expected behavior. By default, Soft-Delete is enabled for Recovery Services Vault (RSV) as a security feature. That said, you do not get the option to delete backup item.

Firstly, you need to disable Soft-Delete before performing delete operation.

Please find the instructions to disable soft delete in the doc link reference:

https://free.blessedness.top/en-us/azure/backup/backup-azure-security-feature-cloud#disabling-soft-delete-using-azure-portal

Next.

In the Azure portal > vault > Go to backup items

select the backup type

Click on stop backup and then delete the backup data.

Refer here: FYI: Permanently deleting soft deleted backup items

If there's no option or you are unable to find the stop/delete backup items option. This usually happens when the items are backed up using the Microsoft Azure Recovery Services (MARS) agent, not through VM or workload backups directly in the portal.

If you are trying to delete backup items for "Azure Backup Agent", you need to follow instructions to

Delete a Microsoft Azure Recovery Services vault - Azure Backup | Microsoft Learn

Note: You need to delete the backup data from "Backup Infrastructure" pane and then go to Azure backup agent console (MARS agent console)" to perform complete deletion of backup items for MARS.

Hope this helps!
Kelly Michetti 0 Reputation points

2025-10-16T06:32:25.3766667+00:00

I already disabled soft-delete multiple times. When I delete the backup data or try to delete the backup items, they always soft delete. They never hard delete. The 'soft-delete' setting is ignored. Read the last sentence in my question more closely. Soft delete IS DISABLED

Soft delete IS DISABLED

Soft delete IS DISABLED

Soft delete IS DISABLED

Soft delete IS DISABLED

Soft delete IS DISABLED

You guys don't actually read the questions do you? You see some text that matches a previous question and you copy paste an answer. Use your brain.
Bharath Y P 1,350 Reputation points Microsoft External Staff Moderator

2025-10-20T16:26:05.12+00:00
Hello Kelly Michetti, thank you for your feedback, and I sincerely apologize for the earlier response. I appreciate you pointing that out.

You might not be able to fully delete backup items from your Recovery Services vault, even if Soft Delete is turned off. This might be caused usually because other security settings like Always-On Soft Delete are still working in the background and stopping the items from being completely removed.

Check the Vault Settings:

Go to your Recovery Services vault > Settings > Properties.

In Security Settings, click Update.

Confirm whether:

Security features for hybrid backups (like MARS or MABS) are turned on.

Always-On Soft Delete is active (if it is, it cannot be disabled).

Disable Hybrid Backup Security Features: If you're using on-premises or hybrid backups, these additional security features can block deletion. Disable them like this:

Go to your Recovery Services > Settings > Properties

Security Settings > click Update and turn off Security Features for hybrid backups.

Or you can use PowerShell script

powershellSet-AzRecoveryServicesVaultProperty -VaultId $vault.Id -DisableHybridBackupSecurityFeature $true

Confirm that Soft Delete is Turned Off: Once the hybrid security settings are disabled, make sure Soft Delete is off:

powershellSet-AzRecoveryServicesVaultProperty -VaultId $vault.Id -SoftDeleteFeatureState Disable

If the setting doesn’t change, that means Always-On Soft Delete is enabled for this vault which can’t be turned off by design.

Undelete Containers Before Deleting Items: If your backup items show up as “soft deleted,” the parent container needs to be undeleted first. Run the following command:

powershellUndo-AzRecoveryServicesBackupContainerDeletion -Container $container -VaultId $vault.ID -Force

Once the container is restored, you can work on individual items.

Undelete and Permanently Delete Backup Items: Bring the backup items back first, then delete them:

powershellUndo-AzRecoveryServicesBackupItemDeletion -Item $item -VaultId $vault.ID -Force

After restoring them, you can hard-delete the backup data:

powershellDisable-AzRecoveryServicesBackupProtection -Item $item -VaultId $vault.ID -RemoveRecoveryPoints -Force

Repeat this for each backup item you need to remove.

If Always-On Soft Delete is Enabled: If the vault has Always-On Soft Delete, it can’t be disabled even by PowerShell or portal. In that case, wait for the retention period (between 14 to 180 days) until data is automatically purged.

Configure and manage enhanced soft delete for Azure Backup - Azure Backup | Microsoft Learn

For further details, Microsoft’s official resources below walk through the same steps:

Soft delete for Azure Backup - Azure Backup | Microsoft Learn

Security features that protect hybrid backups - Azure Backup | Microsoft Learn

1 answer

Your answer

Himanshu Shekhar 1,095 Reputation points Microsoft External Staff Moderator

2025-10-14T06:46:45.94+00:00

We are looking into the issue. Also reached with additional details via private messages
Bharath Y P 1,350 Reputation points Microsoft External Staff Moderator

2025-10-14T08:38:00.96+00:00

Hello Kelly Michetti,

From description you provided, we understand that you are trying to delete a Recovery Services vault in Azure, but it's blocked due to backup items stuck in a soft-deleted state. You've already disabled soft delete and followed the recommended steps, but the items still show as soft-deleted.

This is the expected behavior. By default, Soft-Delete is enabled for Recovery Services Vault (RSV) as a security feature. That said, you do not get the option to delete backup item.

Firstly, you need to disable Soft-Delete before performing delete operation.

Please find the instructions to disable soft delete in the doc link reference:

https://free.blessedness.top/en-us/azure/backup/backup-azure-security-feature-cloud#disabling-soft-delete-using-azure-portal

Next.

In the Azure portal > vault > Go to backup items

select the backup type

Click on stop backup and then delete the backup data.

Refer here: FYI: Permanently deleting soft deleted backup items

If there's no option or you are unable to find the stop/delete backup items option. This usually happens when the items are backed up using the Microsoft Azure Recovery Services (MARS) agent, not through VM or workload backups directly in the portal.

If you are trying to delete backup items for "Azure Backup Agent", you need to follow instructions to

Delete a Microsoft Azure Recovery Services vault - Azure Backup | Microsoft Learn

Note: You need to delete the backup data from "Backup Infrastructure" pane and then go to Azure backup agent console (MARS agent console)" to perform complete deletion of backup items for MARS.

Hope this helps!
Kelly Michetti 0 Reputation points

2025-10-16T06:32:25.3766667+00:00

I already disabled soft-delete multiple times. When I delete the backup data or try to delete the backup items, they always soft delete. They never hard delete. The 'soft-delete' setting is ignored. Read the last sentence in my question more closely. Soft delete IS DISABLED

Soft delete IS DISABLED

Soft delete IS DISABLED

Soft delete IS DISABLED

Soft delete IS DISABLED

Soft delete IS DISABLED

You guys don't actually read the questions do you? You see some text that matches a previous question and you copy paste an answer. Use your brain.

Answer 1

SUNOJ KUMAR YELURU 16,611 MVP Volunteer Moderator

Hello @Kelly Michetti

Verify Soft Delete is Disabled: Confirm in the Recovery Services vault properties.
Undelete the Items: Navigate to Backup Items, find soft-deleted items, and select "Undelete."
Re-Delete Immediately: Once the item is in an active state, delete it again. This should result in a hard delete.
Check for Locks: Ensure no Azure Resource Locks are preventing deletion.
Wait or Contact Support: If the issue persists, wait for the original soft delete period to expire or contact Azure Support for assistance.

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.

Kelly Michetti 0 Reputation points

2025-10-16T06:30:36.1333333+00:00

Read my question, I already did exactly what you said and they still won't hard-delete. That is the problem. Do you realize you just repeated my question in your answer?

Share via

Can't hard delete backup items in VM Recovery Vault, soft delete already disabled

1 answer

Your answer