Recovery Services Vault cannot be deleted — MABS server stuck with Invalid-state backup items after decommission

Question

Recovery Services Vault cannot be deleted — MABS server stuck with Invalid-state backup items after decommission

Marek Pierewoj 0

I am trying to delete a Recovery Services vault to stop incurring costs. The vault is blocked by a registered MABS (Azure Backup Server)

that has two backup items stuck in Invalid protectionState with 0 recovery points:

VM;vm1<guid1>
VM;vm2<guid2>

Steps already taken:

Soft delete - disabled
Enhanced security - disabled
All other backup items (VMs, SQL, file shares) - successfully deleted
Stop Protection + Delete Data attempted from MABS console - reported success but items persisted in Azure
DPM PowerShell Remove-DPMChildDatasource - no protection groups found, no effect on Azure state
MarkedForDeletion flag set to True directly in the DPMDB SQL database
DPMRA and DPM services restarted multiple times
Azure Backup agent uninstalled from the MABS machine
REST API DELETE on both items via /backupFabrics/ActiveDirectory/protectionContainers/Windows;<servername>/protectedItems/ - consistently returns BMSUserErrorInvalidInput across API versions (2016-12-01, 2021-12-01, 2023-04-01)
DELETE /registeredIdentities/<servername> - blocked by items: ServiceContainerNotEmptyWithBackendMessage
DELETE vault?api-version=2024-04-01&forceDeletion=true - returns BMSUserErrorVaultDeletionNotAllowed because of the MABS server registration

Additional context:

Vault has immutabilitySettings: Locked
- Items have 0 recovery points - no actual backup data exists
- Items are of type DPMProtectedItem / AzureBackupServer management type
- The protectionState: Invalid appears to mean the source VMs no longer exist, but Azure will not allow deletion via any REST API path

Question: Is there any supported way to force-remove DPMProtectedItem entries stuck in Invalid state when the MABS server has been decommissioned and the agent is no longer installed? Can I please ask Microsoft Support to help here?

Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-03-31T10:18:08.52+00:00
Hello Marek, it looks like your vault is blocked by orphaned DPMProtectedItem entries in an “Invalid” state (0 recovery points) after the MABS server was decommissioned. Unfortunately there isn’t a supported client-side or REST API command to forcibly remove those orphaned entries once the server/agent is gone.

Invalid protectionState means the source VM no longer exists, but Azure still tracks the item metadata.

MABS registration enforces container integrity: Azure won’t allow vault deletion until all protected items are cleared.

Immutability lock overrides force deletion flags, requiring backend intervention.

These items live as metadata in the vault backend and must be purged by Microsoft.

What to do next:

Open a Azure Support ticket. How to create an Azure support request - Azure supportability | Microsoft Learn

Provide the vault’s resource ID, the protected item names or IDs (VM;vm1<guid1>, VM;vm2<guid2>), and confirm you’ve already disabled soft delete and enhanced security on the vault.

Ask for a backend purge of the orphaned DPMProtectedItem metadata.

Once Support completes the backend purge, you should be able to delete the vault normally (or via the forceDeletion flag if needed).

Hope that helps! Thanks

Reference list:

• Delete an Azure Backup Recovery Services vault: https://learn.microsoft.com/azure/backup/backup-azure-delete-vault
Marek Pierewoj 0 Reputation points

2026-03-31T10:41:12.7666667+00:00

Hey, I have the developer plan and cannot open support case I think. Is there a way to reach to support to get the vaults purged?
Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-03-31T11:07:07.6066667+00:00

Hello Marek, Sure we will help you in that, we have reached out to you in Private messages, could you please check? Thanks