Troubleshoot an Azure Load Balancer that can't be deleted

Summary

This article helps you troubleshoot why you can't delete an Azure Load Balancer or the resource group that contains it.

You usually can't delete an Azure Load Balancer or the resource group that contains it for one of these reasons:

Dependent resources still reference the Load Balancer, so you must remove them first. These resources include an Azure Private Link service, a backend-pool network interface card (NIC) association, outbound rules, load-balancing or inbound-Network Address Translation (NAT) rules, or probes.
A deny assignment blocks the delete because the Load Balancer is platform-managed (created by Azure Kubernetes Service (AKS), Azure Container Apps, or another managed service) or left behind by a failed resource move.
An Azure resource lock or Azure Policy with a deny effect that prevents deletion.

Symptoms

You might experience one or more of the following symptoms:

Deleting a Load Balancer in the Azure portal, with a command line interface (CLI) tool, or as part of a resource group delete returns a failure and the resource remains.
CLI returns an error like Cannot delete resource ... because it is in use or InUseLoadBalancerCannotBeDeleted.
CLI returns CannotDeleteLoadBalancerWithPrivateLinkService with a message like ...since it is referenced by private link service ... Please delete private link service prior to deleting load balancer.
CLI returns ScopeLocked with a message like The scope '...' cannot perform delete operation because following scope(s) are locked.
CLI returns RequestDisallowedByPolicy naming an Azure Policy assignment.
CLI returns an authorization error stating the action is blocked because of a deny assignment.
A resource group delete fails and the only resource that won't delete is the Load Balancer.
The Load Balancer lives in a node resource group named MC_* (AKS) or is owned by another managed service.

Prerequisites

To troubleshoot this issue, you need the following items:

Permissions required: Network Contributor role on the Load Balancer's resource group to remove dependencies and the Load Balancer, User Access Administrator or Owner permissions to remove a resource lock or create a policy exemption, or reader access to the Activity Log to inspect deny assignments.
Tools: Azure CLI 2.x or an AI agent with Azure MCP or CLI access
Required variables and examples of those variables, as shown in the following table

Variable	Description	Example
`{SUBSCRIPTION_ID}`	Azure subscription ID	`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`
`{RESOURCE_GROUP}`	Resource group containing the Load Balancer	`myResourceGroup`
`{RESOURCE_NAME}`	Load Balancer resource name	`myLoadBalancer`

TIP: Each script that's provided in the following sections prompts you for the required values interactively. To open Cloud Shell and answer the prompts, select Try It. The values are cached for that session. Therefore, you enter them only one time.

Diagnostic steps

Note

These steps are strictly for discovery ("read-only"). They don't make changes to your environment.

The problem is identified by running four independent read-only checks in this priority order: resource lock, then Azure Policy, then deny assignment, then dependent resources. Control-plane blockers (like lock, policy, deny assignment) prevent the delete regardless of dependencies, so the process checks them first. Try to fix the first blocker found.

Step 1

Check the exact error code returned by the failed delete. The error code is the primary signal that tells you which blocker you're facing. If you already have the error text from the Azure portal or a previous CLI or Terraform run, use it here. Otherwise, the read-only checks in Step 2-Step 5 confirm the blocker without re-running the delete operation.

Run the following commands in Azure CLI:

# ── Collect inputs (cached if already set in this session) ──
[ -z "$SUBSCRIPTION" ] && read -rp "Subscription ID:    " SUBSCRIPTION
[ -z "$RG" ] && read -rp "Resource Group:     " RG
[ -z "$RESOURCE_NAME" ] && read -rp "Load Balancer Name: " RESOURCE_NAME

# Read-only: confirm the Load Balancer still exists and capture its ID for later steps.
az network lb show \
  --name "$RESOURCE_NAME" \
  --resource-group "$RG" \
  --subscription "$SUBSCRIPTION" \
  --query "{id:id, provisioningState:provisioningState}" \
  --output json

Interpret the results

If you see...	Meaning	Next steps
Delete error code `ScopeLocked` or the message `scope(s) are locked`.	A resource lock blocks deletion.	Perform Step 2.
Delete error code `RequestDisallowedByPolicy`.	An Azure Policy deny effect blocks deletion.	Perform Step 3.
Delete error mentions `deny assignment` (for example, `...does not have authorization...because of a deny assignment`).	A deny assignment blocks deletion.	Perform Step 4.
Delete error like `InUseLoadBalancerCannotBeDeleted`, `CannotDeleteLoadBalancerWithPrivateLinkService` (with the message `...referenced by private link service ... Please delete private link service prior to deleting load balancer`), or `Cannot delete resource ... in use`.	Dependent resources still reference the Load Balancer	Perform Step 5.
You don't have the error text, or it's unclear.	Run the following read-only checks in Step 2-Step 5 in order to find the blocker	Perform Step 2.
`ResourceNotFound`	The Load Balancer is already deleted.	No action needed.

Note

Even if you have an error code from the preceding list, complete the matching read-only checks in Step 2-Step 5 to confirm the blocker before making any changes.

Step 2

Check whether a management lock (CanNotDelete or ReadOnly) exists on the Load Balancer, its resource group, or an inherited parent scope. Locks are inherited downward, so a lock on the resource group or subscription can block deletion.

Run the following commands in Azure CLI:

# ── Collect inputs (cached if already set in this session) ──
[ -z "$SUBSCRIPTION" ] && read -rp "Subscription ID:    " SUBSCRIPTION
[ -z "$RG" ] && read -rp "Resource Group:     " RG
[ -z "$RESOURCE_NAME" ] && read -rp "Load Balancer Name: " RESOURCE_NAME

echo "── Locks on the Load Balancer resource ──"
az lock list \
  --resource "$RESOURCE_NAME" \
  --resource-type "Microsoft.Network/loadBalancers" \
  --resource-group "$RG" \
  --subscription "$SUBSCRIPTION" \
  --query "[].{name:name, level:level, notes:notes}" \
  --output json

echo "── Locks inherited from the resource group ──"
az lock list \
  --resource-group "$RG" \
  --subscription "$SUBSCRIPTION" \
  --query "[].{name:name, level:level, notes:notes}" \
  --output json

echo "── Locks inherited from the subscription ──"
az lock list \
  --subscription "$SUBSCRIPTION" \
  --query "[].{name:name, level:level, notes:notes}" \
  --output json

Interpret the results

If you see...	Meaning	Next steps
Any lock with `"level": "CanNotDelete"` or `"level": "ReadOnly"` at any previously listed scope.	A lock blocks deletion. This is the blocker.	Perform Resolution C.
All three lists return `[]` (no locks).	Locks aren't the blocker.	Perform Step 3.

Step 3

Check whether an Azure Policy assignment with a deny effect at the resource group, subscription, or an inherited management-group scope is blocking the delete operation. A policy that blocks a delete operation returns RequestDisallowedByPolicy and names the policy assignment and definition.

Run the following commands in Azure CLI:

# ── Collect inputs (cached if already set in this session) ──
[ -z "$SUBSCRIPTION" ] && read -rp "Subscription ID:    " SUBSCRIPTION
[ -z "$RG" ] && read -rp "Resource Group:     " RG

# List policy assignments that apply to this resource group, including those
# inherited from the subscription and parent management groups.
az policy assignment list \
  --resource-group "$RG" \
  --subscription "$SUBSCRIPTION" \
  --disable-scope-strict-match \
  --query "[].{name:name, displayName:displayName, policyDefinitionId:policyDefinitionId, scope:scope}" \
  --output json

If your delete error is RequestDisallowedByPolicy, the error text contains the policy assignment name and policy definition ID that blocked it. Match that name against the previous list. The error names the exact assignment and this list confirms its scope.

Interpret the results

If you see...	Meaning	Next steps
The delete error was `RequestDisallowedByPolicy` and the named assignment appears in this list.	An Azure Policy `deny` effect is the blocker.	Perform Resolution D.
No `RequestDisallowedByPolicy` error and no relevant `deny` policy applies.	Azure Policy isn't the blocker.	Perform Step 4.

Step 4

Check whether a deny assignment blocks the delete. Azure-managed services create deny assignments, such as AKS and Container Apps, to protect resources they own. A failed or partial resource move can leave behind a deny assignment. Unlike role assignments, you can't override a deny assignment by granting yourself a role. You must remove the source.

Run the following commands in Azure CLI:

# ── Collect inputs (cached if already set in this session) ──
[ -z "$SUBSCRIPTION" ] && read -rp "Subscription ID:    " SUBSCRIPTION
[ -z "$RG" ] && read -rp "Resource Group:     " RG

# Deny assignments have no dedicated 'az' command; query the ARM API directly.
az rest \
  --method get \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION/resourceGroups/$RG/providers/Microsoft.Authorization/denyAssignments?api-version=2022-04-01" \
  --query "value[].{name:properties.denyAssignmentName, isSystemProtected:properties.isSystemProtected, principals:properties.principals[].displayName, excludePrincipals:properties.excludePrincipals[].displayName, actions:properties.permissions[].actions}" \
  --output json

Interpret the result

If you see...	Meaning	Next steps
One or more entries where `isSystemProtected` is `true` and `actions` includes ``, `/delete`, or `Microsoft.Network/loadBalancers/delete`.	A platform-managed deny assignment owns this Load Balancer.	Perform Resolution B.
A deny assignment that doesn't name a system principal (likely left over from a failed move).	A stale deny assignment is the blocker.	Perform Resolution B.
`value` is empty (`[]`).	Deny assignments aren't the blocker.	Perform Step 5.
`AuthorizationFailed` on the query itself.	You don't have `Microsoft.Authorization/denyAssignments/read` permissions. Request them.	Re-run the step after permissions are granted.

Step 5

Check which dependent resources still reference the Load Balancer. A Load Balancer can't be deleted while a Private Link service, an outbound rule, a load-balancing or inbound-NAT rule, a probe, or a backend-pool NIC association still points to it. This step enumerates all of them so you know exactly what to remove and in what order.

Run the following commands in Azure CLI:

# ── Collect inputs (cached if already set in this session) ──
[ -z "$SUBSCRIPTION" ] && read -rp "Subscription ID:    " SUBSCRIPTION
[ -z "$RG" ] && read -rp "Resource Group:     " RG
[ -z "$RESOURCE_NAME" ] && read -rp "Load Balancer Name: " RESOURCE_NAME

echo "── Load Balancer rule, probe, and backend-pool inventory ──"
az network lb show \
  --name "$RESOURCE_NAME" \
  --resource-group "$RG" \
  --subscription "$SUBSCRIPTION" \
  --query "{outboundRules:outboundRules[].name, loadBalancingRules:loadBalancingRules[].name, inboundNatRules:inboundNatRules[].name, probes:probes[].name, backendPools:backendAddressPools[].name, backendNicAssociations:backendAddressPools[].loadBalancerBackendAddresses[].networkInterfaceIPConfiguration.id, backendIpConfigCount:length(backendAddressPools[0].backendIPConfigurations || [])}" \
  --output json

echo "── Private Link Services that front-end this Load Balancer ──"
az network private-link-service list \
  --resource-group "$RG" \
  --subscription "$SUBSCRIPTION" \
  --query "[?contains(to_string(loadBalancerFrontendIpConfigurations), '$RESOURCE_NAME')].{name:name, fipConfigs:loadBalancerFrontendIpConfigurations[].id}" \
  --output json

Interpret the results

Record every non-empty list. These are the dependencies you must remove and the order they are fixed (the Private Link service first and Load Balancer last).

If you see...	Meaning	Next steps
One or more Private Link services, rules, probes, or backend NIC associations listed.	These dependencies block the delete operation.	Perform Resolution A.
All lists empty and `backendIpConfigCount` is `0`, but Step 2-Step 4 found nothing.	No blocker identified. Re-run the delete operation. If it still fails, open an Azure support request.	Go to the Decision map.

Decision map

Use the following decision map table to determine the appropriate next steps based on your diagnostic results. Route to the first matching row in this order (control-plane blockers before dependencies).

Diagnostic result	Next actions
Step 2 found a `CanNotDelete` or `ReadOnly` lock.	Perform Resolution C.
Step 3 found a blocking Azure Policy (`RequestDisallowedByPolicy`).	Perform Resolution D.
Step 4 found a deny assignment (system-protected or stale).	Perform Resolution B.
Step 5 found a Private Link Service, rules, probes, or backend NIC associations.	Perform Resolution A.
There's no lock, no policy, no deny assignment, or dependency, but the delete operation still fails.	Open an Azure support request.

Resolution A

Dependent resources still reference the Load Balancer. Azure refuses the delete until you remove every reference. Remove the references in this dependency order: Private Link service > outbound rules > load-balancing > inbound-NAT rules > probes > backend pool (NIC associations) > Load Balancer.

Run the following commands in Azure CLI.

Re-run the inventory from Step 5 and record every Private Link service, rule, probe, backend pool, and backend NIC association name. You reference these names in the following steps. Don't proceed until you have the full list.
Delete each Private Link service that front-ends this Load Balancer. A Private Link service holds the strongest reference, so remove it first.

Important

The following commands are all write operations that require your approval before you can run them. Review them to better understand what each command does. Deleting a Private Link service disconnects any private endpoints consuming it.

# ── Collect inputs (cached if already set in this session) ──
[ -z "$SUBSCRIPTION" ] && read -rp "Subscription ID:        " SUBSCRIPTION
[ -z "$RG" ] && read -rp "Resource Group:         " RG
read -rp "Private Link Service Name (from A.1): " PLS_NAME

az network private-link-service delete \
  --name "$PLS_NAME" \
  --resource-group "$RG" \
  --subscription "$SUBSCRIPTION"

Repeat for each Private Link service listed in step 1.

Delete each outbound rule.

Important