A cloud-based identity and access management service for securing user authentication and resource access
Use Microsoft Graph PowerShell to remove or disable the blocking enterprise applications, then retry tenant deletion.
Follow the documented sequence for tenants that are blocked by undeletable enterprise apps:
- Install and connect the required modules
Connect to the tenant that must be deleted using a homed Global Administrator account:Install-Module Microsoft.Graph Install-Module -Name Az
Verify that the connected tenant is the one to be deleted:Connect-MgGraph -Scopes "Application.ReadWrite.All"
Then verify the same tenant with Az (safety check so apps are not removed from the wrong tenant):Get-MgDomainClear-AzContext -Scope CurrentUser Connect-AzAccount -Tenant <object id of the tenant you are attempting to delete> Get-AzContext - Remove all service principals (enterprise applications) Run the removal in a loop, because some deletions can fail on the first attempt due to dependencies:
Run this command multiple times until no more service principals can be removed.Get-MgServicePrincipal -All | ForEach-Object { Remove-MgServicePrincipal -ServicePrincipalId $_.Id } - If some service principals cannot be deleted (for example, Microsoft internal apps), disable them and retry
Disabling them ensures they no longer block tenant deletion, even if some remain undeletable.$ServicePrincipalUpdate = @{ "accountEnabled" = "false" } Get-MgServicePrincipal -All | ForEach-Object { Update-MgServicePrincipal -ServicePrincipalId $_.Id -BodyParameter $ServicePrincipalUpdate } Get-MgServicePrincipal -All | ForEach-Object { Remove-MgServicePrincipal -ServicePrincipalId $_.Id } - After the service principals are removed or disabled, delete the tenant
- Sign in to the Microsoft Entra admin center as Global Administrator.
- Go to Microsoft Entra ID → Overview → Manage tenants.
- Select the tenant and choose Delete.
- If any checks still fail (for example, subscriptions or users), resolve those, then repeat the delete action.
This process is explicitly designed for the scenario where enterprise applications (including Microsoft internal ones) prevent tenant deletion.
References: