How to delete a private DNS zone in Azure?

Hello William Menezes,

Deleting a stuck private DNS zone in Azure due to provisioning failures often requires Azure CLI or PowerShell with specific flags to bypass the error state, as the portal and basic Remove-AzResource commands fail on "terminal provisioning state 'Failed'". This is common with incomplete provisions where the resource is in a limbo state—here's how to resolve it using Azure CLI (recommended for precision) or PowerShell, ensuring no dependencies first

Prerequisites

• Install Azure CLI (az login to authenticate) or use Az PowerShell module.
• Confirm no VNets linked: az network private-dns zone vnet-links list -g <rg> -n <zone-name> (delete if any).
• No record sets: az network private-dns record-set list -g <rg> -n <zone-name> (delete non-default like SOA/NS via az network private-dns record-set delete).
• Owner role confirmed—no locks via az lock list -g <rg>.

Solution 1: Azure CLI (Preferred)

Run these commands to force deletion:

1. List and verify the zone:

   
      az network private-dns zone show -g az104-rg4 -n private.acmecorp.com
   
   

2. Delete all non-default record sets (if any):

   
      az network private-dns record-set list -g az104-rg4 -n private.acmecorp.com --query "[?name!='@'].name" -o tsv | xargs -I {} az network private-dns record-set delete -g az104-rg4 -n private.acmecorp.com -z private.acmecorp.com -t {} -y
   
   

3. Force delete the zone:

   
      az network private-dns zone delete -g az104-rg4 -n private.acmecorp.com -y --no-wait
   
   

   • --no-wait skips provisioning checks for failed states.
   • Wait 5-10 mins, then confirm: az network private-dns zone show -g az104-rg4 -n private.acmecorp.com (should 404).[2][1]

Solution 2: PowerShell (Advanced)

If CLI isn't available, use Remove-AzDnsZone with API version override:

1. Import module: Import-Module Az.Network
2. Force delete:

   
      $zone = Get-AzDnsZone -ResourceGroupName "az104-rg4" -Name "private.acmecorp.com" -ErrorAction SilentlyContinue
   
      if ($zone) {
   
          Remove-AzDnsZone -ResourceGroupName "az104-rg4" -Name "private.acmecorp.com" -Force -ApiVersion "2018-05-01"  # Older API ignores failed state
   
      }
   
   

   • The -ApiVersion "2018-05-01" bypasses modern validation causing BadRequest.
   • If still fails, retry after deleting resource locks or using ARM template deletion via Remove-AzResource -ResourceType Microsoft.Network/privateDnsZones -ResourceName private.acmecorp.com -ResourceGroupName az104-rg4 -Force with custom provider API.

Troubleshooting

• If "BadRequest" persists: Check activity log (az monitor activity-log list -g az104-rg4) for correlated errors (e.g., CorrelationId: 4d701a5b-4760-4eba-a2c2-6ec57789422a)—often hidden dependencies.
• White screen/portal error: Use Azure Resource Graph: az graph query -q "Resources | where type == 'microsoft.network/privatednszones' and resourceGroup == 'az104-rg4'" to inspect.
• Post-deletion: If recreation needed, ensure VNet links are set up correctly to avoid re-provision fails.

Test in a non-prod RG first. If dependencies are deeper (e.g., linked services), share the full activity log for more help!

Best Regards,

Jerald Felix

Hi Jerald -

Unfortunately, none of the steps you mentioned worked. I'm continuing to get the "BadRequest" response. I reviewed the activity log, but I didn't see any new information.

I ran your "az graph query" command, and can see the resource with 1 record set (the default "@") and 0 VNet links. The provisioning state shows "Succeeded", but of course I'm still unable to delete the resource.

Best,

William