Azure bastion gateway cannot be deleted

Jack Williams hello & thanks for join me here at Q&A portal,

this is a stuck Microsoft.Network resource state. A 409 during delete plus terminal provisioning state Failed usually means the Bastion control-plane operation is wedged, not that changing the config will fix it. See if there are no locks on the Bastion resource, resource group, public IP, or VNet. Try delete Bastion resource first, then public IP, then subnet if needed. Azure Bastion troubleshooting https://learn.microsoft.com/en-us/azure/bastion/troubleshoot

If delete still returns 409, capture the failed operation from Activity Log with correlation ID and timestamp. Microsoft documents failed provisioning state for Network resources https://learn.microsoft.com/en-us/azure/networking/troubleshoot-failed-state Do not keep retrying config changes. If the resource is already in Failed and every update returns InternalServerError, this needs backend cleanup.

Open Azure Support ticket under Azure Bastion and ask for force delete/backend cleanup of failed Bastion resource. Include Bastion resource ID, public IP ID, VNet/subnet ID, region, latest 409 correlation ID, and the failed provisioning error.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

Hi Jack Williams,

Your Azure Bastion resource is stuck in a terminal provisioning state of "Failed". This means:

The last time Azure tried to create, update, or delete it, the operation failed.

Azure now treats the resource as "in a broken state" and won't let you delete or change it normally.

Any attempt to delete returns a 409 Conflict error.

• Any attempt to update/configure it fails with:

  "The resource operation completed with terminal provisioning state 'Failed'."

The most reliable workaround is to re-apply the current configuration using a Get + Set operation. This often resets the internal provisioning state from Failed back to Succeeded.

Powershell:

1. Open PowerShell as Administrator.
2. Connect to Azure and select your subscription:

      Connect-AzAccount 
      Set-AzContext -SubscriptionId "your-subscription-id"
   

3. Get the Bastion object and reset it:

      $bastion = Get-AzBastion  -ResourceGroupName "YourResourceGroupName" -Name "YourBastionName"
      Set-AzBastion -InputObject $bastion
   

4. Wait a couple of minutes, then check the Bastion in the portal or run:

      Get-AzBastion -ResourceGroupName "YourResourceGroupName" -Name "YourBastionName" | Select-Object Name, ProvisioningState
   

   Look for ProvisioningState to show Succeeded.

Once the provisioning state is back to Succeeded, try deleting:

Remove-AzBastion `
  -ResourceGroupName "YourResourceGroupName" `
  -Name "YourBastionName" `
  -Force

Azure CLI

az network bastion delete `
  --resource-group "YourResourceGroupName" `
  --name "YourBastionName"

Some users found that if PowerShell failed, the Azure CLI version worked (or vice versa), so try both if one doesn't work.

If the issue still persists, could you please share the required details via private message for further investigation?

Update:

As discussed, the Azure Bastion gateway was impacted by a backend-stuck operation. The backend team has successfully cleared the operation, and the Bastion gateway can now be deleted successfully.

Please let us know if you encounter any further issues.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.