Share via

VM Scale Set hr-dev-web-vmss is stuck in a marked‑for‑deletion state

Jasmin leroux 40 Reputation points
2026-04-02T23:22:53.4066667+00:00

We are unable to complete deletion of resource group hr-dev-rg-xxejvp due to a Virtual Machine Scale Set (hr-dev-web-vmss) that is marked for deletion. The VMSS returns HTTP 409 – OperationNotAllowed for all update operations, which prevents us from removing dependent resources.

Because the VMSS cannot be updated, we are unable to detach Application Gateway backend pool references, Network Security Group associations, or subnet dependencies. This blocks deletion of the Application Gateway, Public IP address, subnet, and ultimately the resource group.

The VMSS is stuck in a deleting state and cannot be modified or recovered from the customer side. Assistance is required to clear or complete the VMSS deletion so dependent resources can be removed.

Azure Virtual Machine Scale Sets
Azure Virtual Machine Scale Sets

Azure compute resources that are used to create and manage groups of heterogeneous load-balanced virtual machines.

Answer accepted by question author

  1. Jilakara Hemalatha 12,915 Reputation points Microsoft External Staff Moderator
    2026-04-03T00:35:16.3266667+00:00

    Hello Jasmin,

    The issue was not caused by a fault in the VM Scale Set itself, but due to a dependency failure with the associated Azure Application Gateway. The Application Gateway configuration contained a reference to an SSL certificate stored in a Key Vault that had been deleted or was no longer reachable. As a result, all update operations on the Application Gateway were failing during its rolling upgrade process.

    Since VMSS deletion requires backend network cleanup, including NIC detachment, these operations internally triggered Application Gateway updates. Because those updates consistently failed, the VMSS remained stuck in a “marked for deletion” state, returning HTTP 409 responses for any further operations. This behavior is expected when a resource is pending deletion but blocked by dependent failures.

    To resolve the issue, the engineering team applied a backend mitigation by enabling a tenant-level setting to bypass the listener-related failure and allow the Application Gateway to recover. Once the gateway reached a healthy state and completed its pending operations, the dependency chain was cleared.

    Following this, the VM Scale Set deletion completed successfully, and the customer was able to proceed with deleting the remaining resources and the entire resource group without further issues.

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2026-04-02T23:23:05.9133333+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    The VM scale set is in a transient “marked for deletion” / deleting state that blocks any further customer-side updates (HTTP 409 OperationNotAllowed). In this state, dependent resources (Application Gateway backend pool, NSG, subnet, etc.) also cannot be detached because the VMSS cannot be modified.

    From the available guidance, there is no supported way to “unblock” or override a VMSS that is already stuck in deletion from the customer side. The only customer-controllable prerequisite is that all VMs belonging to the scale set must be deleted before the scale set itself can be removed:

    • When a Virtual Machine Scale Set in Flexible orchestration mode still has associated VMs, attempts to delete the scale set fail with:

      OperationNotAllowed. Deletion of Virtual Machine Scale Set isn't allowed as it contains one or more VMs. Please delete or detach the VM(s) before deleting the Virtual Machine Scale Set.

    • The documented resolution is to delete all VMs associated with the scale set, then delete the scale set again.

    In this scenario, the VMSS is already in a deleting/marked-for-deletion state and is rejecting all update operations, so the remaining steps must be handled by Azure support on the platform side (forcibly completing or clearing the stuck delete operation and then removing the dependent resources). Opening a support ticket with the full error details and resource IDs is required; there is no additional CLI or portal operation documented that can clear a VMSS once it is stuck in this state.

    References:

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.