Cannot delete a storage account with containers with locked immutability policy

Question

All,

I created a storage account as part of a training. I deleted the VM that it was associated with. But, I cannot delete the storage account, nor the resource group. I am afraid that I will keep getting billed for it as it keeps on using resources. When I try to delete the storage account, I always get the error: " failed as resources with identifiers Microsoft.Storage/storageAccounts/XXXXXX,Microsoft.Storage/storageAccounts/XXXXX1' could not be deleted. ..... (Code: ResourceGroupDeletionBlocked) Account XXXXX Containers YYYYY have locked immutability policy."
It looks like the immutability policy was set by default to 180 days.
How can I please get this storage account and the containers deleted?

Thanks for the help!

Answer 1

@BONHOMME, JEAN P Firstly, apologies for the delay in responding here and any inconvenience this issue may have caused. Kindly try the following steps to isolate the issue:

When a time-based retention policy is applied to a container, all blobs in the container will stay in the immutable state for the duration of the effective retention period. Container and storage account deletion is also not permitted if there are any blobs in a container that are protected by a legal hold or a locked time-based policy. A legal hold policy will protect against blob, container, and storage account deletion. Both unlocked and locked time-based policies will protect against blob deletion for the specified time. Both unlocked and locked time-based policies will protect against container deletion only if at least one blob exists within the container. Only a container with a locked time-based policy will protect against storage account deletions; containers with unlocked time-based policies do not offer storage account deletion protection nor compliance.

So please check the legal holds if any along with immutable policy set within containers. Once the blobs are also removed, try to delete the container and then the storage account.

• https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage#faq
• https://learn.microsoft.com/en-us/azure/storage/scripts/storage-blobs-container-delete-by-prefix-powershell

There is a similar thread discussion in the SO forum, please refer to the suggestion and let me know the status.

FAQ
Can I remove a locked time-based retention policy or legal hold?

Only unlocked time-based retention policies can be removed from a container. Once a time-based retention policy is locked, it cannot be removed; only effective retention period extensions are allowed. Legal hold tags can be deleted. When all legal tags are deleted, the legal hold is removed.

What happens if I try to delete a container with a time-based retention policy or legal hold?

The Delete Container operation will fail if at least one blob exists within the container with either a locked or unlocked time-based retention policy or if the container has a legal hold. The Delete Container operation will succeed only if no blobs exist within the container and there are no legal holds.

What happens if I try to delete a storage account with a container that has a time-based retention policy or legal hold?

The storage account deletion will fail if there is at least one container with a legal hold set or a locked time-based policy. A container with an unlocked time-based policy does not protect against storage account deletion. You must remove all legal holds and delete all locked containers before you can delete the storage account. For information on container deletion, see the preceding question. You can also apply further delete protections for your storage account with Azure Resource Manager locks.

Blob Containers - Delete Immutability Policy Aborts an unlocked immutability policy. The response of delete has immutabilityPeriodSinceCreationInDays set to 0. ETag in If-Match is required for this operation. Deleting a locked immutability policy is not allowed, the only way is to delete the container after deleting all expired blobs inside the policy locked container.

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

---------------------------------------------------------------------------------------------------------------------------------------------------------------

Please don’t forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Thank you! I understand. I thought there would be some other way to delete it. I will wait for the retention period to expire and try to delete it again.