Title: Unable to Delete Orphaned Azure ML Registry Resource Group After Managed Application Deletion (System Deny Assignment)

Question

Title: Unable to Delete Orphaned Azure ML Registry Resource Group After Managed Application Deletion (System Deny Assignment)

Antonieta Pinto Rebelo 0

Hello Microsoft Community,

We are experiencing an issue with an orphaned Azure resource group created automatically by an Azure Machine Learning Registry as part of an Azure Managed Application deployment.

Background

We are the publisher of an Azure Managed Application deployed through Azure Marketplace.

As part of our Managed Application deployment, we create an Azure Machine Learning Registry. When the registry is created, Azure automatically provisions an additional resource group containing supporting resources, including:

Azure Storage Account

Azure Container Registry

This additional resource group is created automatically by Azure Machine Learning and is separate from the Managed Application's managed resource group.

The Issue

When a customer deletes the Managed Application and its managed resource group, the Azure Machine Learning Registry is also deleted.

However, the additional resource group created by Azure Machine Learning Registry, along with its supporting resources, remains in the customer's subscription.

The customer is now unable to delete this remaining resource group because of a system-managed deny assignment restricting deletion, even though the original Azure ML Registry no longer exists.

As the publisher, we also want to ensure that these resources can be properly cleaned up when customers uninstall our Managed Application.

Questions

Is there a supported way for the customer to force-delete an orphaned resource group created automatically by Azure Machine Learning Registry?

Since the original Azure ML Registry has already been deleted, how can the system-managed deny assignment on the remaining resource group be removed?

Does the customer need to open an Azure Support request to have Microsoft remove the deny assignment and delete the orphaned resources?

Is there anything we can implement on the publisher side to ensure that the Azure ML Registry's automatically created resource group and supporting resources are deleted when the customer deletes the Managed Application?

Is this expected Azure ML Registry lifecycle behavior, or could it indicate an incomplete cleanup operation?

We would appreciate guidance on the recommended and supported cleanup procedure, especially for Azure Marketplace Managed Applications where the customer does not have sufficient permissions to delete these resources.

0 comments

1 answer

Your answer

Answer 1

Because the Azure Machine Learning registry has already been deleted while its service-managed resource group and system-protected deny assignment remain, the customer should open an Azure technical support request for backend cleanup rather than attempt to force-delete the resource group.

Supported cleanup procedure

Azure-created deny assignments are system protected and cannot be edited or deleted directly by customers, including subscription Owners. A deny assignment also takes precedence over granted RBAC permissions.^1^

In the orphaned resource group, open Access control (IAM) → Deny assignments.
Select the assignment and capture:
- Assignment name and ID
- Description
- Scope
- Denied permissions
- System protected value
Optionally collect the same information with PowerShell:

$resourceGroup = "<orphaned-resource-group>"

Get-AzDenyAssignment -ResourceGroupName $resourceGroup |
    Select-Object Id, DenyAssignmentName, Description,
        Scope, IsSystemProtected, Actions, NotActions |
    Format-List

Listing requires Microsoft.Authorization/denyAssignments/read, which is included in most built-in roles.^1^

From the Azure portal, select ? → Help + Support, describe the issue, and select Create a support request. Alternatively, open the resource group and select Support + Troubleshooting.^2^
Route the request to Azure Machine Learning and include:
- Subscription and orphaned resource-group IDs
- Deleted registry name and original resource ID
- Managed Application resource ID and deletion timestamp
- Deny-assignment ID and output above
- Failed resource-group deletion operation/error
- A statement that the parent Microsoft.MachineLearningServices/registries resource no longer exists

Creating the request requires subscription-level Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission. Technical support also requires an applicable support plan.^2^

Comparable orphaned managed-resource cases have required an Azure backend engineer to remove stale dependencies or protected resources before resource-group deletion could complete.^3^^4^

Do not use Resource Explorer to delete the storage account or ACR directly: that approach does not bypass a system-protected deny assignment, and deletion is irreversible.

Lifecycle interpretation

The additional resource group is part of the Azure ML registry’s service-managed dependency model. Registry creation provisions storage accounts and a container registry, and the registry ARM resource exposes a managedResourceGroup property when system-created resources are present.^5^^6^

The existence of that backing resource group and its protection is therefore expected. Its persistence after successful deletion of the parent registry is not documented as a normal terminal lifecycle state. Treat this case as incomplete or stale service cleanup requiring Azure Machine Learning engineering investigation.

The Managed Application guarantee applies to its own managed resource group: deleting the Managed Application deletes that managed resource group.^7^ It does not establish that an additional resource group created later by Azure ML is owned by the Microsoft.Solutions Managed Application lifecycle.

Publisher-side prevention

For future deployments, delete the Azure ML registry explicitly and wait for the long-running operation to complete before deleting the Managed Application. The supported CLI operation is:^8^

az ml registry delete \
  --name "<registry-name>" \
  --resource-group "<registry-resource-group>"

Implement this as a documented deprovisioning operation or publisher-controlled cleanup workflow while the Managed Application and publisher authorization still exist. After completion, verify that the registry and its managed resource group have disappeared before allowing final Managed Application deletion.

There is no documented Managed Application template setting that adopts the Azure ML-created external resource group into the Managed Application’s managed resource group or removes an Azure ML-owned deny assignment. Consequently, a cleanup action that runs only after the Managed Application has been deleted cannot reliably repair this condition; the remaining instance requires Microsoft Support.

References