Deleted AWS instances can not be deleted from ARC machine inventory

Question

Deleted AWS instances can not be deleted from ARC machine inventory

Tracy Mosley 0

I have two AWS instances that were previously successfully connected to ARC. We have FULLY removed these EC2 instances on the AWS side (not suspended, not terminated, fully removed). I have deleted them from the ARC inventory several times, and every time the cloud connector rescans, they get added back. Some aspect of the resources must remain on the Azure Defender for the Cloud side. What do I need to do to fully remove any references that may be allowing these bogus references to be re-added?

Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-03-11T17:11:06.7+00:00

Hello Tracy Mosley

Thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates.

Thanks,

Suchitra.
Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-03-11T21:34:59.32+00:00
Hello Tracy Mosley

Could you please share us the below details?

Can you confirm that the EC2 instance IDs no longer appear when queried via AWS APIs (not just the EC2 console)?

Were these EC2 instances ever part of an Auto Scaling Group, Launch Template, Spot Fleet, or Spot Request?

Is AWS Config enabled in the account, and does it still show historical records for these instance IDs?

Is the AWS account connected to Azure using the Azure Arc Multicloud Connector?

Which solutions are enabled on the connector: Inventory, Arc onboarding, or both?

Is the connector configured at the AWS Organization level or a single AWS account level?

Are all AWS regions enabled for scanning, or are some regions excluded?

When deleting the machines, did you delete only the Arc-enabled server resource (Microsoft.HybridCompute/machines), or also the resource under the AWS_ resource group?

Have you tried disabling the Inventory and/or Arc onboarding solution before deleting the machines?

Is the AWS account also onboarded to Microsoft Defender for Cloud using an AWS security connector?

After deletion, do the machines still appear in Defender for Cloud inventory or recommendations?

How soon after deletion do the machines reappear in Azure Arc (same day, next scan, or later)?

Has this behavior occurred consistently across multiple rescan cycles?

Has the AWS CloudFormation stack created for Azure Arc or Defender for Cloud ever been modified or partially removed?

Have you attempted to remove and re-create the multicloud connector to rule out stale connector metadata?

Thanks,

Suchitra.
Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-03-13T13:32:18.01+00:00

Hello @Tracy Mosley@Tracy Mosley

Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution and click "upvote" as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.
Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-03-16T10:56:24.3433333+00:00

Hello Tracy Mosley, I just wanted to kindly follow up to check, If the provided answer is helpful, it would be great if you could Accept the answer and up-vote. This not only helps us but also makes it easier for other community members who might face the same issue. Thanks
Naveena Patlolla 9,310 Reputation points Microsoft External Staff Moderator

2026-03-20T04:52:49.3133333+00:00

Hello Tracy Mosley, I just wanted to check if the solution worked for you. If not, please let us know if you need any assistance—we’re always here to help.

Also, if you found the information helpful, please don’t forget to accept the answer and upvote it. This helps other community members as well and is greatly appreciated.

2 answers

Your answer

Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-03-11T17:11:06.7+00:00

Hello Tracy Mosley

Thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates.

Thanks,

Suchitra.
Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-03-11T21:34:59.32+00:00

Hello Tracy Mosley

Could you please share us the below details?

Can you confirm that the EC2 instance IDs no longer appear when queried via AWS APIs (not just the EC2 console)?

Were these EC2 instances ever part of an Auto Scaling Group, Launch Template, Spot Fleet, or Spot Request?

Is AWS Config enabled in the account, and does it still show historical records for these instance IDs?

Is the AWS account connected to Azure using the Azure Arc Multicloud Connector?

Which solutions are enabled on the connector: Inventory, Arc onboarding, or both?

Is the connector configured at the AWS Organization level or a single AWS account level?

Are all AWS regions enabled for scanning, or are some regions excluded?

When deleting the machines, did you delete only the Arc-enabled server resource (Microsoft.HybridCompute/machines), or also the resource under the AWS_ resource group?

Have you tried disabling the Inventory and/or Arc onboarding solution before deleting the machines?

Is the AWS account also onboarded to Microsoft Defender for Cloud using an AWS security connector?

After deletion, do the machines still appear in Defender for Cloud inventory or recommendations?

How soon after deletion do the machines reappear in Azure Arc (same day, next scan, or later)?

Has this behavior occurred consistently across multiple rescan cycles?

Has the AWS CloudFormation stack created for Azure Arc or Defender for Cloud ever been modified or partially removed?

Have you attempted to remove and re-create the multicloud connector to rule out stale connector metadata?

Thanks,

Suchitra.
Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-03-13T13:32:18.01+00:00

Hello @Tracy Mosley@Tracy Mosley

Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution and click "upvote" as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.
Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-03-16T10:56:24.3433333+00:00

Hello Tracy Mosley, I just wanted to kindly follow up to check, If the provided answer is helpful, it would be great if you could Accept the answer and up-vote. This not only helps us but also makes it easier for other community members who might face the same issue. Thanks
Naveena Patlolla 9,310 Reputation points Microsoft External Staff Moderator

2026-03-20T04:52:49.3133333+00:00

Hello Tracy Mosley, I just wanted to check if the solution worked for you. If not, please let us know if you need any assistance—we’re always here to help.

Also, if you found the information helpful, please don’t forget to accept the answer and upvote it. This helps other community members as well and is greatly appreciated.

Answer 1

Tracy Mosley hey hey,

what is happening is that Azure Arc itself is not recreating them randomly, the AWS cloud connector is rediscovering them from whatever it still sees on the AWS side. Even if the ec2 instances are terminated if they still appear in AWS APIs or if there is stale metadata in the connected account scope, Arc will pull them back in during the next scan.

Look in AWS that those instances are truly gone and not just terminated but still listed in the ec2 console with a terminated state. Also check if there are any leftover hybrid activation resources, IAM roles, or SSM registrations tied to those instance IDs.

Then in Azure go to Azure Arc > AWS connector and review the connected account configuration. Sometimes the connector scope includes resources that still exist in AWS Config or inventory services so Arc keeps reimporting them. You may need to disconnect and reconnect the AWS account or remove and recreate the AWS connector to force a clean inventory sync.

See if Defender for Cloud environment settings for that AWS account and make sure there are no lingering resources tracked there. If after confirming they are completely gone in AWS they still reappear, open a support ticket because that usually means the backend connector cache needs to be cleared.

rgds,

Alex

Answer 2

Hello Tracy Mosley

What you are seeing is expected behavior when AWS is connected through the Azure Arc Multicloud Connector (Inventory and/or Arc onboarding solution).

Azure Arc Multicloud Connector performs periodic inventory scans
- The connector regularly queries AWS APIs and re‑projects discovered resources into Azure.
- Any resource that still appears discoverable from AWS APIs will be recreated in Azure on the next sync.
Deleting the Arc machine in Azure does not block rediscovery
- Deleting Microsoft.HybridCompute/machines only removes the Azure representation.
- On the next scan, if the connector still detects the resource, it is re‑created automatically.
Connector‑based resources are not “owned” by Defender for Cloud
- Defender for Cloud consumes data from the connector but does not control lifecycle deletion of inventory objects.
- There is no Defender‑side “cache” or manual purge option for individual machines.

The most common root cause is even when an EC2 instance is terminated, one or more AWS artifacts can still exist, causing the connector to rediscover it:

Instance metadata still visible via AWS APIs for a short or extended period
Orphaned Auto Scaling Group, Launch Template, or Spot Fleet references
AWS Config / CloudTrail historical records still being returned
Organization‑level inventory scan returning stale entries

Because the Arc Multicloud Connector is source‑of‑truth driven by AWS, Azure will keep recreating the objects until the source is clean.

Please try below provided workarounds and let us know if it is helpfull or not:

Remove or disable the AWS connector solution

If these AWS instances should never be managed again:

Go to Azure Arc → Multicloud connectors
Select the AWS connector
Disable the Inventory solution and/or Arc onboarding solution
After disabling, manually delete the Azure resources

Once the solution is disabled, periodic sync stops, and deleted resources will not be recreated.

Fully remove the AWS connector (cleanest reset)

If you want a full reset:

Delete the AWS security connector / multicloud connector in Azure
Remove the CloudFormation stack in AWS
Confirm no AWS IAM roles created for Azure Arc remain
Re‑create the connector only if needed

This clears all discovery paths.

Confirm AWS truly no longer returns the instance:

Before expecting Azure to stop rediscovering:

Verify the instance does not appear in AWS EC2 APIs
Check for:
- Auto Scaling Groups
  - Launch Templates
    - Spot requests
      - AWS Config historical visibility

If AWS returns it, Azure Arc must re‑add it by design.

Please have a look into below reference links for more details:

Multicloud inventory behavior https://learn.microsoft.com/azure/azure-arc/multicloud-connector/view-multicloud-inventory
Resource representation & removal behavior https://learn.microsoft.com/azure/azure-arc/multicloud-connector/resource-representation
Troubleshooting multicloud connectors https://learn.microsoft.com/azure/azure-arc/multicloud-connector/troubleshoot-multicloud-connector

So, Azure Arc Multicloud Connector treats AWS as the source of truth. Deleting Arc machines in Azure does not prevent rediscovery during periodic scans. To permanently remove these instances, you must either fully remove the AWS connector (or disable the Inventory/Arc onboarding solutions) or ensure the instances and all related artifacts no longer appear in AWS APIs. There is no Defender‑side or Arc‑side manual purge mechanism for individual machines while the connector remains active.

If the provided information helpful then please click "upvote" it.

If you have any other queries, then please share us the above requested details.

Thanks,
Suchitra.

Share via

Deleted AWS instances can not be deleted from ARC machine inventory

2 answers

Your answer