I need to end an Azure Pay as You Go Backup Subscription but cannot remove backup items from Recovery Vaults

Question

I need to end an Azure Pay as You Go Backup Subscription but cannot remove backup items from Recovery Vaults

Matt Spencer 0

We decommissioned our old MABS server. We have serveral Recovery Services Vaults with old backup data no longer needed. When trying to delete the server from Azure in any of them, I am getting "Container already in deferred unregister state"

I have tried the PowerShell methods. Nothing seems to work. I need MS Support.

Suchitra Suregaunkar 16,125 Reputation points Microsoft External Staff Moderator

2026-06-23T19:34:55.8966667+00:00
Hello Matt Spencer

Thanks for reaching out Microsoft Q&A platform.

The error "Container already in deferred unregister state" (internally ContainerAlreadyInDeferUnregisterState) typically appears when a backup container — in your case, the decommissioned MABS / Azure Backup Server registration, has been marked for unregistration but still has dependent backup items (often in soft‑deleted or "Invalid" protection state) that prevent the backend from completing the unregister workflow. Because the agent is no longer installed on the source MABS server, the standard "Stop protection → Delete data → Unregister" sequence cannot complete, and PowerShell/REST attempts return errors such as BMSUserErrorInvalidInput, ServiceContainerNotEmptyWithBackendMessage, or BMSUserErrorVaultDeletionNotAllowed.

Could you please confirm you've completed the following on each affected Recovery Services vault:

Step 1 — Disable Soft Delete and Security Settings (Hybrid workloads)

Open the Recovery Services vault → Properties → Security Settings → Update.

Uncheck**"Enable soft delete and security settings for hybrid workload"** (and disable Enhanced Security if enabled).

Save.

Reference: Soft delete for Azure Backup and Delete an Azure Backup Recovery Services vault

Step 2 — Purge any soft‑deleted backup items:

Go to Backup items → filter by Azure Backup Server / DPM → for each item in soft‑deleted state, select Undelete → Stop backup → Delete backup data.

Step 3 — Delete the MABS Server registration:
Navigate to Backup Infrastructure → Backup Management Servers, select the orphaned MABS server, click Delete, re‑enter the server name and a reason, then confirm. This triggers a backend job to remove the server and all associated items.

Step 4 — If deletion still fails with ContainerAlreadyInDeferUnregisterState

This is the state you're hitting. When the MABS agent has already been uninstalled and the container is stuck in the deferred unregister state, the front‑end (portal, PowerShell, CLI, REST API) cannot force‑purge the container —Azure Backup enforces this by design as part of its transactional integrity and ransomware protection guarantees. The backend container lock can only be cleared by the Azure Backup product/engineering team through an internal cleanup workflow.

Thanks,

Suchitra.
Matt Spencer 0 Reputation points

2026-06-23T21:41:07.7+00:00

We are at Step 4 for ALL Vaults not just HawkRSV2. I need to clean out all these vaults. The MABS server has been decommissioned. I have tried deleting the server multiple times I still get the error.
Suchitra Suregaunkar 16,125 Reputation points Microsoft External Staff Moderator

2026-06-23T21:58:29.7066667+00:00

Hello Matt Spencer

Could you please have a look into private message and fill the consent link.

Thanks,
Suchitra.

Suchitra Suregaunkar 16,125 Microsoft External Staff Moderator

Hello Matt Spencer It looks like your old MABS‐registered server is stuck in a “deferred unregister” state because the vault still has soft-deleted backup data and a pending unregister for that container. Azure Backup holds deleted items for 14 days (soft delete) by default, which prevents you from fully unregistering the container or deleting the vault until those retention periods expire or you manually purge the items. Here’s a sequence you can try to force the cleanup:

Disable soft delete on the vault

   ```powershell
   $vault = Get-AzRecoveryServicesVault -ResourceGroupName "<your-RG>" -Name "<your-vault>"
   Set-AzRecoveryServicesVaultProperty -Vault $vault -SoftDeleteFeatureState Disable


2. Undelete and permanently remove any soft-deleted backup items  

   # List items pending deletion
   $toBeDeleted = Get-AzRecoveryServicesBackupItem -VaultId $vault.ID -DeleteState ToBeDeleted
   # Permanently delete them
   $toBeDeleted | ForEach-Object { Remove-AzRecoveryServicesBackupItem -Item $_ -Force }


3. Unregister the backup container  


   # Retrieve the MABS container(s)
   $containers = Get-AzRecoveryServicesBackupContainer -VaultId $vault.ID -BackupManagementType MAB
   # Unregister them
   $containers | ForEach-Object { Unregister-AzRecoveryServicesBackupContainer -Container $_ -Force }

Unregister the old MABS server from the vault

   # Find your backup management server
   $server = Get-AzRecoveryServicesBackupManagementServer -VaultId $vault.ID |
             Where-Object { $_.FriendlyName -eq "<YourMABSServerName>" }
   # Unregister it
   Unregister-AzRecoveryServicesBackupManagementServer -AzureRmBackupManagementServer $server -VaultId $vault.ID

Wait for any remaining deferred-unregister operations to complete (soft-delete retention is 14 days). Once the container is gone and the server is unregistered, you’ll be able to delete the vault and terminate your backup subscription.

Thanks,

Suchitra.

1 answer

Your answer

Matt Spencer 0 Reputation points

2026-06-23T21:41:07.7+00:00

We are at Step 4 for ALL Vaults not just HawkRSV2. I need to clean out all these vaults. The MABS server has been decommissioned. I have tried deleting the server multiple times I still get the error.
Suchitra Suregaunkar 16,125 Reputation points Microsoft External Staff Moderator

2026-06-23T21:58:29.7066667+00:00

Hello Matt Spencer

Could you please have a look into private message and fill the consent link.

Thanks,
Suchitra.

Answer 1

That error means Azure Backup accepted the MABS container-unregister request, but the backend has not finished removing it. Repeating Unregister-AzRecoveryServicesBackupContainer will not help.

Confirm there are no MABS/DPM backup items, including items in Soft Deleted or To Be Deleted state. If soft delete is configurable, disable it, undelete those items, then stop protection and delete the backup data again. A vault cannot be deleted while protected or soft-deleted data, backup management servers, storage accounts, or private endpoints remain. After the item list is empty, retry removing the MABS server.

Because all vaults are already at deferred unregister and the server no longer exists, the remaining lock requires Azure Backup backend cleanup. Open one support request listing every vault resource ID, subscription ID, MABS container name, UTC retry time, error code, and any job or correlation IDs. Do not cancel the subscription until support confirms the containers and vaults are removed.