Share via

Unable to Delete an AKS Cluster Due to Circular Dependencies

Yogesh Prajapat 0 Reputation points Microsoft Employee
2026-04-08T07:44:17.9366667+00:00

When deleting the cluster (present in East US region) I am getting this error:

Network security group /subscriptions/.../providers/Microsoft.Network/networkSecurityGroups/NRMS-t5beisocfdtvwAKS-...-AKS-SUBNET cannot be deleted because it is in use by the following resources: /.../providers/Microsoft.Network/virtualNetworks/AKS-VNET-11744656/subnets/AKS-SUBNET. 
In order to delete the Network security group, remove the association with the resource(s).

When disassociating the NSG from Subnet, getting this error:

Failed to save subnet 'AKS-SUBNET'. Error: 'Subnet /subscriptions/..../providers/Microsoft.Network/virtualNetworks/AKS-VNET-../subnets/AKS-SUBNET can not be updated when parent Virtual Network /subscriptions/.../providers/Microsoft.Network/virtualNetworks/aks-vnet-.. deletion was attempted earlier.'

When Deleting the Subnet, getting this error:

Failed to delete subnet 'AKS-SUBNET'. Error: No registered resource provider found for location 'eastus2euap' and API version '2016-07-01' for type 'locations/deleteVirtualNetworkOrSubnets'. The supported api-versions are '2025-08-01, 2025-06-01, 2025-01-01, 2024-01-01, 2023-05-01, 2023-04-01, 2023-01-01, 2022-09-01, 2022-05-01, 2021-09-01, 2021-08-01, 2021-06-01, 2021-05-01, 2021-04-01, 2021-02-01, 2021-01-01, 2020-08-01-preview, 2019-06-01, 2019-04-01, 2018-11-01, 2018-07-01, 2018-03-01-preview, 2018-02-01, 2017-10-01, 2017-06-01, 2016-12-01, 2016-07-01, 2016-05-01'. The supported locations are 'eastus, eastus2, westus, westeurope, eastasia, southeastasia, japaneast, japanwest, northcentralus, southcentralus, centralus, northeurope, brazilsouth, australiaeast, australiasoutheast, southindia, centralindia, westindia, canadaeast, canadacentral, westus2, westcentralus, uksouth, ukwest, koreacentral, koreasouth, francecentral, australiacentral, southafricanorth, uaenorth, switzerlandnorth, germanywestcentral, norwayeast, westus3, jioindiawest, swedencentral, qatarcentral, polandcentral, italynorth, israelcentral, mexicocentral, spaincentral, newzealandnorth, indonesiacentral, malaysiawest, chilecentral, austriaeast, belgiumcentral, denmarkeast'.

When Deleting the MC RG of the AKS Cluster getting this error:


Failed to delete resource group MC_...._eastus: Deletion of resource group 'MC_..._eastus' failed as resources with identifiers 'Microsoft.Network/virtualNetworks/aks-vnet-..,Microsoft.Network/networkSecurityGroups/NRMS-t5beisocfdtvwAKS-VNET-11744656-AKS-SUBNET' could not be deleted. The provisioning state of the resource group will be rolled back. The tracking Id is '98e4cfe9-e8b5-4d99-8008-4de9217b4ba5'. Please check audit logs for more details. (Code: ResourceGroupDeletionBlocked) The request to delete the resource 'Microsoft.Network/virtualNetworks/aks-vnet-11744656' failed. subscription id 'b5....', activity id 'd9d27e2a-6111-4df6-829d-621d85674b9f', request correlation id '98e4cfe9-e8b5-4d99-8008-4de9217b4ba5'. (Code: ResourceDeletionFailed, Target: /subscriptions/.../providers/Microsoft.Network/virtualNetworks/aks-vnet-11744656) Network security group /subscriptions/.../providers/Microsoft.Network/networkSecurityGroups/NRMS-t5beisocfdtvwAKS-VNET-11744656-AKS-SUBNET cannot be deleted because it is in use by the following resources: /subscriptions/.../providers/Microsoft.Network/virtualNetworks/AKS-VNET-11744656/subnets/AKS-SUBNET. In order to delete the Network security group, remove the association with the resource(s). To learn how to do this, see aka.ms/deletensg. (Code: InUseNetworkSecurityGroupCannotBeDeleted, Target: /subscriptions/..../providers/Microsoft.Network/networkSecurityGroups/NRMS-t5beisocfdtvwAKS-VNET-11744656-AKS-SUBNET)

So, neither I can remove the association of NSG with subnet, nor delete the subnet, VNet, or the Managed Resource Group of the cluster.

I am stuck with similar problems for three other clusters as well (in total 4 clusters, two from East US, and other two from West US region).

The common issue I see in all the cluster deletion is, all of them are stuck due to aks-subnet.

I have tried the following approaches on four of my AKS Clutsers, and all the approaches failed to delete the AKS Cluster:

  1. Initiated the deletion of cluster by just: az aks delete command
  2. Disassociating all the NSG from subnets, then deleting the subnets. Now initiating az aks delete command.
  3. Same as [2] but not doing any operation on the default Subnet and the NSG associated with this.

All the retries for deleting the cluster or other resources have failed too. Have also tried with az rest commands for patching the state of the VNet or directly deleting the subnets, but those have failed as well.

Note: The direct az aks delete failed with different error, wherein we had our custom Subnet along with it's NSG. Hence [2], [3] approached included steps to remove this custom subnet first.

For two of the AKS Clusters have also got this error, which have no specific error details:

Can anyone suggest on how to come out of this loop and delete the cluster successfully?

Also suggest what's the ideal way of deleting the cluster so that we are not stuck in this problem again.

Azure Kubernetes Service
Azure Kubernetes Service

An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.


Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.