Share via

Recovery Services Vault cannot be deleted — MABS server stuck with Invalid-state backup items after decommission

Marek Pierewoj 0 Reputation points
2026-03-31T08:37:13.1966667+00:00

I am trying to delete a Recovery Services vault to stop incurring costs. The vault is blocked by a registered MABS (Azure Backup Server)

that has two backup items stuck in Invalid protectionState with 0 recovery points:

  • VM;vm1<guid1>
  • VM;vm2<guid2>

Steps already taken:

  1. Soft delete - disabled
  2. Enhanced security - disabled
  3. All other backup items (VMs, SQL, file shares) - successfully deleted
  4. Stop Protection + Delete Data attempted from MABS console - reported success but items persisted in Azure
  5. DPM PowerShell Remove-DPMChildDatasource - no protection groups found, no effect on Azure state
  6. MarkedForDeletion flag set to True directly in the DPMDB SQL database
  7. DPMRA and DPM services restarted multiple times
  8. Azure Backup agent uninstalled from the MABS machine
  9. REST API DELETE on both items via /backupFabrics/ActiveDirectory/protectionContainers/Windows;<servername>/protectedItems/ - consistently returns BMSUserErrorInvalidInput across API versions (2016-12-01, 2021-12-01, 2023-04-01)
  10. DELETE /registeredIdentities/<servername> - blocked by items: ServiceContainerNotEmptyWithBackendMessage
  11. DELETE vault?api-version=2024-04-01&forceDeletion=true - returns BMSUserErrorVaultDeletionNotAllowed because of the MABS server registration

Additional context:

  • Vault has immutabilitySettings: Locked
    • Items have 0 recovery points - no actual backup data exists
    • Items are of type DPMProtectedItem / AzureBackupServer management type
    • The protectionState: Invalid appears to mean the source VMs no longer exist, but Azure will not allow deletion via any REST API path

Question: Is there any supported way to force-remove DPMProtectedItem entries stuck in Invalid state when the MABS server has been decommissioned and the agent is no longer installed? Can I please ask Microsoft Support to help here?

Azure Backup
Azure Backup

An Azure backup service that provides built-in management at scale.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator
    2026-03-31T10:18:08.52+00:00

    Hello Marek, it looks like your vault is blocked by orphaned DPMProtectedItem entries in an “Invalid” state (0 recovery points) after the MABS server was decommissioned. Unfortunately there isn’t a supported client-side or REST API command to forcibly remove those orphaned entries once the server/agent is gone.

    1. Invalid protectionState means the source VM no longer exists, but Azure still tracks the item metadata.
    2. MABS registration enforces container integrity: Azure won’t allow vault deletion until all protected items are cleared.
    3. Immutability lock overrides force deletion flags, requiring backend intervention.

    These items live as metadata in the vault backend and must be purged by Microsoft.

    What to do next:

    1. Open a Azure Support ticket. How to create an Azure support request - Azure supportability | Microsoft Learn
    2. Provide the vault’s resource ID, the protected item names or IDs (VM;vm1<guid1>, VM;vm2<guid2>), and confirm you’ve already disabled soft delete and enhanced security on the vault.
    3. Ask for a backend purge of the orphaned DPMProtectedItem metadata.

    Once Support completes the backend purge, you should be able to delete the vault normally (or via the forceDeletion flag if needed).

    Hope that helps! Thanks

    Reference list:

    • Delete an Azure Backup Recovery Services vault: https://learn.microsoft.com/azure/backup/backup-azure-delete-vault

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.