how to stop/remove Azure backup agent in Azure

I got following errors:

(BMSUserErrorSoftDeleteStateAlwaysOn, ServiceContainerNotEmptyWithBackendMessage, the CloudInternalError from the PUT, "Unsupported WorkloadType: FileFolder")

Hello @Gaurav Gupta

Thank you for reaching out to the Microsoft Q&A Team.

The combination you're seeing — BMSUserErrorSoftDeleteStateAlwaysOn plus ServiceContainerNotEmptyWithBackendMessage, with the CLI rejecting FileFolder — points at three separate walls, and the good news is that only one of them actually needs to come down. The unresponsive 3-dot menu on Backup Items is a symptom, not the cause: with always-on soft delete, the operations that menu would offer aren't available to you anymore.

Here's what's happening. Azure Backup now enforces soft delete by default on Recovery Services vaults, and the docs are explicit that "Disabling soft delete is not allowed for any module or API versions" — that's your BMSUserErrorSoftDeleteStateAlwaysOn. Separately, az backup only manages Azure VM backups, which is exactly why your MARS File/Folder item comes back as "Unsupported WorkloadType: FileFolder". And ServiceContainerNotEmptyWithBackendMessage means the MARS container still holds at least one item — MARS always keeps the last recovery point until you explicitly stop the schedule and delete the stored backups.

The key thing most people miss: you don't need to permanently purge anything to delete the vault. In GA, "Soft delete of a vault is allowed when the vault is empty or it has only soft-deleted backup items or containers." Soft-deleted is good enough.

1. Stop using Azure CLI for this vault and switch to the portal or Azure PowerShell. The CLI cannot touch a FileFolder item at all, so every retry there is a dead end. ✔ To verify: az backup item list will not return your MARS item as a manageable Azure VM item — confirm and move on.
2. If the MARS agent machine still exists, open the MARS console → Actions → Schedule Backup → Stop using this backup schedule and delete all of the stored backups → Next → Finish. It will ask for a Security PIN: portal → vault → Settings → Properties → Security PIN → Generate. Copy it fast — it's valid for only five minutes. ✔ To verify: the Modify Backup Progress page shows "Deleted backup data will be retained for 14 days. After that time, backup data will be permanently deleted."
3. In the portal, go to Backup Infrastructure → Protected Servers → Azure Backup Agent (not Backup Items — this is the pane that actually works for MARS). Select the server, read the warning, tick the consent checkbox, select Delete. This also removes the corresponding backup items in the vault. ✔ To verify: refresh Protected Servers — the list should be empty. Notification reads "Stopping backup and deleting backup data for Backup Item. Successfully completed the operation."
4. Delete the vault. Vault Overview → Delete. ✔ To verify: go to Recovery Services Vaults → Manage Deleted Vaults — your vault should be listed there with its scheduled purge time. That's success, not failure.

Workaround note: Everything above removes the vault from your active inventory, but it is not an immediate permanent purge. The data sits in soft-deleted state for the retention period — 14 days by default, up to 180 if the vault was configured that way — and there's no charge for the default 14 days. There is no supported way to shorten that window yourself.

Documentation references

• Secure by default with soft delete for Azure Backup — https://learn.microsoft.com/en-us/azure/backup/secure-by-default — (covers "Disable Soft Delete action", "Delete Vault action", and soft-delete retention)
• Delete an Azure Backup Recovery Services vault — https://learn.microsoft.com/en-us/azure/backup/backup-azure-delete-vault — (covers "Delete backup items from the MARS management console", "Delete protected items on-premises", and the CLI limitation)
• Configure and manage soft delete in Azure Backup — https://learn.microsoft.com/en-us/azure/backup/backup-azure-enhanced-soft-delete-configure-manage — (covers "Unregister containers" and "Manage soft deleted vaults")

If Step 3 fails with ServiceContainerNotEmptyWithBackendMessage and Protected Servers is already empty, or if that CloudInternalError PUT comes back, the container is held on the backend and no portal/PowerShell/CLI command will clear it — that needs Microsoft to purge it.

Kindly let us know if the above helps or you need further assistance on this issue.

Hello @Gaurav Gupta

Thank you for reaching out to Microsoft Q&A. We apologize for the inconvenience caused by this issue.

Based on the information you provided, we would like to gather some additional details and perform a few validation steps. If you have PowerShell access, could you please run the following commands and share the results?

Check if the backup items is a MARS/Azure backup Agent item:

$vault = Get-AzRecoveryServicesVault `

-ResourceGroupName "<ResourceGroup>" `

-Name "<VaultName>"

Set-AzRecoveryServicesVaultContext -Vault $vault

Get-AzRecoveryServicesBackupContainer `

-ContainerType Windows `

-Status Registered

Note : If containers are returned, note the container name.

List Azure backup Agent (MARS) backup items:

$container = Get-AzRecoveryServicesBackupContainer `

-ContainerType Windows `

-FriendlyName "<ServerName>"

Get-AzRecoveryServicesBackupItem `

-Container $container `

-WorkloadType AzureFiles

Note : If the command fails, capture the complete error output.

Attempt to stop protection and delete backup data:

$item = Get-AzRecoveryServicesBackupItem `

-Container $container `

-WorkloadType AzureFiles

Disable-AzRecoveryServicesBackupProtection `

-Item $item `

-RemoveRecoveryPoints `

-Force

Check for Registered MARS servers:

Get-AzRecoveryServicesBackupContainer `

-ContainerType Windows `

-Status Registered |

Select FriendlyName, RegistrationStatus

If backups have already been removed, unregister the server:

$container = Get-AzRecoveryServicesBackupContainer `

-ContainerType Windows `

-FriendlyName "<ServerName>"

Unregister-AzRecoveryServicesBackupContainer `

-Container $container `

-Force

Check Soft Delete state:

Get-AzRecoveryServicesVaultProperty `

-VaultId $vault.ID

Once you have executed the commands, please share the outputs, especially any error messages, failed operations, activity logs, or correlation IDs. This information will help us investigate the orphaned Restore Point Collection further and determine the appropriate next steps.

We appreciate your cooperation and look forward to your update. Thank you.

Regards,

Venkat.M

Hello @Gaurav Gupta

Could you please let us know if the comment above resolved your issue? If you need any further assistance, feel free to reach out—we're always here to support you.

If you found the comment helpful, please consider clicking "Upvote it."

Thank you.