Unable to delete a orphaned VPN gateway

Question

Unable to delete a orphaned VPN gateway

Lokesh V 0

I have a VPN gateway which is failed state since it doesn't have any virtual hub attached with it.

ubuntu@ip-172-31-19-1:~$ az network vpn-gateway show \
  -g QA_Aug \
  -n mcn-vpngw-sc-qcrn9z-japaneast \
  --query "{name:name,location:location,state:provisioningState,hub:virtualHub.id}" \
  -o json
{
  "hub": null,
  "location": "japaneast",
  "name": "mcn-vpngw-sc-qcrn9z-japaneast",
  "state": "Failed"
}

So, i have created a hub in the same region to attach the orphaned VPN to it, but when i try to attach it with the Hub I am getting InternalServerError.

ubuntu@ip-172-31-19-1:~$ az network vhub show   -g QA_Aug   -n new-hub   --query "{name:name,location:location,state:provisioningState,id:id}"   -o json      {
  "id": "/subscriptions/e3de723e-e527-4610-85a4-87a3b1d7a37c/resourceGroups/QA_Aug/providers/Microsoft.Network/virtualHubs/new-hub",
  "location": "japaneast",
  "name": "new-hub",
  "state": "Succeeded"
}


ubuntu@ip-172-31-19-1:~$ az network vpn-gateway update \
  -g QA_Aug \
  -n mcn-vpngw-sc-qcrn9z-japaneast \
  --vhub "/subscriptions/e3de723e-e527-4610-85a4-87a3b1d7a37c/resourceGroups/QA_Aug/providers/Microsoft.Network/virtualHubs/new-hub"
(InternalServerError) An error occurred.
Code: InternalServerError
Message: An error occurred.

Now I am neither able to delete the VPN gateway nor make it provisioned success. How this VPN can be deleted from the subscription?

0 comments

1 answer

Your answer

Answer 1

Hi Lokesh,

From the output you shared, the VPN Gateway is in a Failed provisioning state and its virtualHub property is currently null. Since attaching the newly created hub is also returning InternalServerError, this looks more like a stuck/orphaned resource state than a normal dependency issue.

Before escalating to Microsoft Support, I would check the following:

Verify whether there are any VPN connections or VPN sites still associated with the gateway:

az network vpn-gateway show --resource-group <resource-group> --name <vpn-gateway-name>

Also check the Virtual WAN hub for any remaining VPN connections/sites and remove any valid dependencies before retrying the deletion.

If the gateway remains in Failed state, try retrieving and updating the resource rather than creating another hub. For Azure Virtual WAN VPN gateways, the supported PowerShell cmdlet is:

Get-AzVpnGateway -ResourceGroupName "<resource-group>" -Name "<vpn-gateway-name>"

You can then retry the delete operation:

Remove-AzVpnGateway -ResourceGroupName "<resource-group>" -Name "<vpn-gateway-name>" -Force

Microsoft documentation:

https://learn.microsoft.com/en-us/powershell/module/az.network/remove-azvpngateway⁠

If the DELETE operation continues to return InternalServerError and there are no remaining connections/dependencies, this may require Microsoft-side backend cleanup. In that situation, I would recommend opening an Azure support request and providing the resource ID, subscription ID, resource group, region, provisioning state, and the exact InternalServerError correlation/request details.

Microsoft also documents that VPN gateway resources may need to be deleted in the correct dependency order:

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-delete-vnet-gateway-portal⁠

Since your gateway is specifically an Azure Virtual WAN VPN Gateway, the REST API also supports deleting the VPN gateway directly:

https://learn.microsoft.com/en-us/rest/api/virtualwan/vpn-gateways/delete⁠

I would avoid repeatedly creating new hubs just to attach the orphaned gateway. If the gateway remains detached and stuck in Failed state after dependency checks and a delete attempt, Microsoft Support may need to clear the backend resource state.