A cloud-based identity and access management service for securing user authentication and resource access
There are a few common reasons why an Entra application cannot be deleted even if listed as owner.
- Check required role and location of the object
- For Enterprise applications (service principals), the Delete button is disabled unless the account has one of these roles or is the service principal owner:
- Global Administrator
- Cloud Application Administrator
- Application Administrator
- Owner of the service principal
- If the app is a Microsoft application, it cannot be deleted from the UI regardless of role.
- If the service principal is for a managed identity, it cannot be deleted from Enterprise applications; it must be managed from the corresponding Azure resource instead.
- Delete the enterprise application (service principal) If the app is an enterprise application added to the tenant and the account has the required role:
Using Entra admin center:
- Sign in to https://entra.microsoft.com as at least Cloud Application Administrator.
- Go to Entra ID → Enterprise apps | All applications.
- Search and select the application.
- Under Manage, select Properties.
- At the top of the Properties pane, select Delete, then confirm.
Using Microsoft Graph PowerShell:
- Connect with the right scope:
Connect-MgGraph -Scopes 'Application.ReadWrite.All' - List service principals and find the one to delete:
Get-MgServicePrincipal - Delete it:
Remove-MgServicePrincipal -ServicePrincipalId 'aaaaaaaa-bbbb-cccc-1111-222222222222'
Using Microsoft Entra PowerShell:
- Connect:
Connect-Entra -Scopes 'Application.ReadWrite.All' - Get and delete by display name:
Get-EntraServicePrincipal -Filter "displayName eq 'Test-app1'" | Remove-EntraServicePrincipal - Delete the application object (not just the service principal)
If the issue is with the application object itself, use
Remove-EntraApplicationwith the ApplicationId:
Remove-EntraApplication -ApplicationId <application-id>
- Behavior after deletion
- After deletion, the enterprise application stays in the recycle bin for 30 days and can be restored during that period.
- After 30 days it is hard-deleted automatically.
- If delete is still disabled
- Confirm the app is not a Microsoft first‑party app.
- Confirm it is not a managed identity service principal.
- Confirm the signed-in account has one of the required roles above, not just “owner” of some related resource.
- If all conditions are met and the button is still disabled, follow the guidance under Unable to delete an application in the troubleshooting article.
References:
- Unable to delete an application due to disabled Delete button
- Delete an enterprise application (portal)
- Troubleshoot common problems adding or removing an application to Microsoft Entra ID
- Delete an enterprise application (ms-graph)
- Delete an enterprise application (ms-powershell)
- Delete an enterprise application (entra-powershell)
- Remove-EntraApplication