[Priority Developer Support] Unable to delete Backup Instance/Vault due to Immutable Lock - Need Escalation

Hello @Aviv

Because your vault is configured as an immutable vault, Azure will block any operation that deletes recovery points before their expiry dates. Here’s the high-level flow to remove everything and delete the vault—assuming your immutability setting is not already locked irreversibly:

1. Check the vault’s immutability state: • In the Azure portal, go to your Recovery Services Vault → Properties → Immutable Settings. • If the setting shows “Enabled” (but not locked), you can turn it off here (or via PowerShell) to allow deletions. • If it’s in the “Enabled and locked” state, that lock is irreversible—there is no supported “break-glass” backend procedure to disable immutability.
2. Disable immutability (if it isn’t locked) : • Portal: toggle Immutable Settings to “Disabled” → Save • PowerShell (example):

      
      $vault = Get-AzRecoveryServicesVault –Name "<vaultName>" –ResourceGroup "<rg>"
      $vault.ImmutableVault = $false
      Set-AzRecoveryServicesVault –Vault $vault
      
   

3. Stop protection and delete backup data for each backup item : • Portal: Recovery Services Vault → Backup Items → select your AzureDatabaseForPGFlexServer item → Stop backup → choose “Delete backup data.” • PowerShell: use Stop-AzDataProtectionBackupInstance (or Stop-AzRecoveryServicesBackupProtection) with the appropriate flags to remove recovery points.
4. Purge soft-deleted items (if soft delete is enabled on the vault) : • Portal: Vault → Properties → Soft delete → temporarily disable if needed → delete any soft-deleted items → re-enable soft delete.
5. Clean up any protected servers or storage accounts : • Vault → Backup infrastructure → Protected Servers / Storage Accounts → unregister or delete all entries.
6. Delete the vault : • Once there are no backup items, soft-deleted objects, or protected-server dependencies, go to Vault → Overview → Delete.

Could you please share us the below details?

1. What exact state do you see under Immutable Settings “Enabled” or “Enabled and locked”?
2. Is soft delete enabled on the vault?
3. Are there any Multi-User Authorization (MUA) or Privileged Identity Management policies governing this vault?
4. Can you share the Azure region of the vault?

Thanks,

Suchitra.

Hi Suchitra Suregaunkar,

Thank you for your assistance. I have performed a deep dive into the vault settings and identified a critical blocker that requires backend intervention.

Current Findings:

Region: Israel Central

Vault Security State: Immutable Vault: Enabled | Locked

Soft Delete: Disabled

The Conflict: Because the legacy vault is in a Locked immutable state, the datasource (PostgreSQL Flexible Server) remains permanently mapped to this vault.

Error Encountered: When attempting to migrate protection to a new V2 vault, I receive UserErrorDppDatasourceAlreadyHasBackupInstance.

PowerShell Failure: Attempts to sync or update the instance fail with UserErrorInvalidRequestParameter due to a current ProtectionStopped status.

Since the vault is in a Locked state, I understand the recovery points themselves cannot be deleted until expiry. However, this is preventing me from protecting my production database in a new environment.

Could you please open a private support case or provide a secure channel so I can share the following sensitive details:

Specific Subscription ID and Resource Names (currently scrubbed for this public thread).

The Correlation IDs and Activity IDs for the failed disassociation attempts.

Request for a backend disassociation/unlinking of the datasource from the locked vault.

I need to move my database protection to the new vault immediately while allowing the legacy vault to expire naturally in the background.

Best regards, Aviv

Hello @Aviv

Thanks for sharing the details. We will check with backend team and assist you on this issue.

Thanks,

Suchitra.

Hello @Aviv

We have an update that removing the immutability lock requires backend intervention and customer authorization due to security concerns, including potential ransomware risks. The process to remove the lock can take around 30 days.

We will keep you posted further updates.

Thanks,
Suchitra.

Hello @Aviv

I wanted to share an update that PG team has been applied fix on this issue and After April 15th you can able to delete backup vault.

Thank You.