How to delete a file share that's within a lock protected storage account?

Question

How to delete a file share that's within a lock protected storage account?

MichaelB-2136 150

Hi, based on the discussion on my previous question here i set up a new, empty test file share so I could restore another one of my in-use file shares to the new empty one, to ensure the backups were working correctly.

I have done this and verified the data successfully, but when attempting to delete the new file share i'm met with a message that it's protected via a lock. When I navigate to my storage account there is a lock called AzureBAckupProtectionLock that auto applies to any storage account connected to a Vault which mine is.

So how do I delete the new file share that i'm no longer in need of? Thanks

MichaelB-2136 150 Reputation points

2026-04-01T15:15:51.22+00:00

If i remove or change the storage account lock to delete the file share then re-apply the lock is there a chance it causes an issue with the exisiting file shares or backups that are already in the vault?
Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-04-01T15:54:04.1866667+00:00
Hello @MichaelB-2136

Thank you for posting your query on Microsoft Q&A platform.

When Azure Backup is enabled for any Azure File Share in a storage account, Azure Backup automatically applies an Azure Resource Manager (ARM) delete lock named AzureBackupProtectionLock on the storage account.

This behavior is by design to prevent accidental deletion of backup‑protected Azure File Shares and their backup data. Because the lock is applied at the storage account level, individual file shares inside the account cannot be deleted while the lock exists.

Reference:

Azure Backup applies management locks to prevent accidental deletions: https://learn.microsoft.com/azure/backup/backup-azure-files

Azure resource locks block delete operations for protected resources https://learn.microsoft.com/azure/storage/common/lock-account-resource

Please have a look into below possible ways to delete the unneeded file share:

You must stop backup for that specific file share first. Because as long as a file share is protected by Azure Backup, Azure Backup intentionally prevents its deletion via the AzureBackupProtectionLock.

Go to Recovery Services Vault / Backup Center

Locate the Azure File Share backup item

Select Stop backup

Choose Retain backup data or Delete backup data as per requirement

After protection is stopped, delete the Azure File Share from the storage account

This does not impact other protected file shares and does not break existing backups.

About removing the AzureBackupProtectionLock:

The lock exists only to protect backed‑up resources

The lock can be removed only after backups are stopped

Removing the lock without stopping backups is not recommended

Removing or re‑applying the lock will not affect existing backups as long as:

Backup is not stopped for production file shares

Backup data is not deleted

Re‑applying the lock does not affect:

Existing file shares

Existing recovery points

Ongoing backup schedules

The lock is a safety control, not the backup mechanism itself.

AzureBackupProtectionLock is expected and by design

Individual Azure File Shares cannot be deleted while protected

Stop backup for the specific share, then delete it

Other file shares and backups remain unaffected

Could you please let us know if the comment above resolved your issue? If you need any further assistance, feel free to reach out, we're always here to support you.

If you found the comment helpful, please consider clicking "Upvote it."

Thanks,

Suchitra.
MichaelB-2136 150 Reputation points

2026-04-01T15:57:22.26+00:00

Hi Suchitra, thanks for your response, however the file share itself has no backup enabled on it, I specifically clicked no as it was only a test file share. The storage account the file share is in is connected to my security vault for the other file shares.
Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-04-01T16:21:52.4633333+00:00
Hello @MichaelB-2136

Thanks for responding back.

As you confirmed “The file share itself has no backup enabled on it. I explicitly selected No. However, the storage account is connected to a Recovery Services vault for other file shares.”

This behavior is expected and by design, even when the specific file share itself is not protected.

Microsoft Azure Backup applies the AzureBackupProtectionLock at the storage account level not per file share.

Once any Azure File Share in a storage account is protected by Azure Backup, the entire storage account is locked to prevent deletion of any file shares inside it, including:

newly created file shares

file shares that were never enabled for backup

empty or test file shares

There is no per‑file‑share exception once the storage account is under Azure Backup protection.

Azure Backup does not evaluate locks at individual file share scope

The lock exists to protect backup metadata, snapshots, and restore consistency

Even deleting an “unprotected” file share could remove dependencies used by Azure Backup at the storage account level

AzureBackupProtectionLock is intentional and mandatory

It blocks delete operations for all file shares in the account

This applies regardless of whether the specific share has backup enabled

To remove such file shares, backup must be stopped for all Azure Files in the storage account, or the test file share should be created in a separate storage account not associated with a Recovery Services vault.

Thanks,
Suchitra.

1 answer

Your answer

MichaelB-2136 150 Reputation points

2026-04-01T15:15:51.22+00:00

If i remove or change the storage account lock to delete the file share then re-apply the lock is there a chance it causes an issue with the exisiting file shares or backups that are already in the vault?
MichaelB-2136 150 Reputation points

2026-04-01T15:57:22.26+00:00

Hi Suchitra, thanks for your response, however the file share itself has no backup enabled on it, I specifically clicked no as it was only a test file share. The storage account the file share is in is connected to my security vault for the other file shares.
Suchitra Suregaunkar 11,150 Reputation points Microsoft External Staff Moderator

2026-04-01T16:21:52.4633333+00:00

Hello @MichaelB-2136

Thanks for responding back.

As you confirmed “The file share itself has no backup enabled on it. I explicitly selected No. However, the storage account is connected to a Recovery Services vault for other file shares.”

This behavior is expected and by design, even when the specific file share itself is not protected.

Microsoft Azure Backup applies the AzureBackupProtectionLock at the storage account level not per file share.

Once any Azure File Share in a storage account is protected by Azure Backup, the entire storage account is locked to prevent deletion of any file shares inside it, including:

newly created file shares

file shares that were never enabled for backup

empty or test file shares

There is no per‑file‑share exception once the storage account is under Azure Backup protection.

Azure Backup does not evaluate locks at individual file share scope

The lock exists to protect backup metadata, snapshots, and restore consistency

Even deleting an “unprotected” file share could remove dependencies used by Azure Backup at the storage account level

AzureBackupProtectionLock is intentional and mandatory

It blocks delete operations for all file shares in the account

This applies regardless of whether the specific share has backup enabled

To remove such file shares, backup must be stopped for all Azure Files in the storage account, or the test file share should be created in a separate storage account not associated with a Recovery Services vault.

Thanks,
Suchitra.

Answer 1

Azure Backup applies a delete lock (AzureBackupProtectionLock) on the storage account to prevent accidental deletion of the account and any file shares in it. Because of this lock, deleting the test file share directly is blocked.

To delete the unneeded file share, use one of these approaches:

Remove or change the storage account lock
- Go to the storage account in the Azure portal.
- Open Locks.
- Either remove the AzureBackupProtectionLock or change it from a delete lock to a read lock (if currently a modify/delete lock), depending on what is configured.
- After the delete restriction is removed, delete the file share (for example, via File shares → select share → Delete share, or using Remove-AzRmStorageShare / az storage share-rm delete).
- Be aware that removing or loosening the lock temporarily exposes the storage account and all file shares to possible accidental deletion.
Remove locks/leases created by value-added services
- Azure Backup and other services may also place share leases or additional locks on specific file shares or snapshots.
- Follow the guidance in the Azure Files troubleshooting article to remove resource locks and leases that block modification or deletion of the share. This may involve running the provided PowerShell script that removes all resource locks and leases on the storage account and its file shares.
- After locks/leases are removed, delete the test file share.

Note: Removing locks or leases that Azure Backup uses can affect backup and restore operations and may allow deletion of protected shares or snapshots. Review backup requirements before permanently changing locks.

References:

Share via

How to delete a file share that's within a lock protected storage account?

1 answer

Your answer