Unable to delete orphaned Managed Identity service principals

Question

Unable to delete orphaned Managed Identity service principals

Diego Gardina 0

Hello!

In Enterprise Applications (Entra ID), I found 14 orphaned system-assigned Managed Identity service principals, that are associated with deleted Azure subscriprions/resources, but persists in Entra ID.

I also wrote a script to delete them via Graph API using PowerShell from my local machine but I'm not able to delete them neither this way; probably I should open a (technical?) ticket to support but I'm wondering if there's still something I could try before.

PS: I have correct RBAC permissions and roles.

Thanks in advance.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-19T13:38:20.3533333+00:00

Hello Diego Gardina,

We need few details to proceed further. Please check your Private messages tab and provide those details.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-19T13:38:20.3533333+00:00

Hello Diego Gardina,

We need few details to proceed further. Please check your Private messages tab and provide those details.

Answer 1

System-assigned managed identity service principals behave differently from regular enterprise apps and can’t be deleted in the same way.

Key points and options:

Delete behavior for managed identities

For service principals that correspond to a managed identity, deletion is not supported from Enterprise applications.
These must be managed from the Azure resource that owns the managed identity, not directly from Entra ID.
When the underlying resource/subscription is deleted, the managed identity’s service principal becomes orphaned and is handled by the platform lifecycle.

Why the Delete button is disabled / Graph delete fails

In Enterprise applications, the Delete button is disabled for service principals that are managed identities.
Attempts to delete these service principals via Microsoft Graph/PowerShell will fail for the same reason: they are protected objects tied to managed identity lifecycle.

Soft-delete and cleanup behavior

Managed identities are soft-deleted.
The soft-deleted managed identity service principal appears in the recycle bin for up to 30 days after deletion.
It cannot be restored or permanently deleted manually.
After the retention period, Entra ID permanently deletes the managed identity service principal automatically.

What can be done now

If the backing Azure resources/subscriptions are already deleted and these are confirmed to be system-assigned managed identities, there is no supported way to force-delete them from Entra ID.
The only available action is to wait for the automatic cleanup (up to 30 days from deletion of the identity/resource).
Opening a support ticket is only useful if the objects are not actually managed identities or if they persist beyond the documented retention behavior.

If any of the 14 objects are not managed identities (for example, regular service principals), those can be removed using Microsoft Graph PowerShell with Remove-MgServicePrincipal as described in the tenant-cleanup guidance, but this does not apply to system-assigned managed identities.

References: