Azure App Service Managed Certificate Stuck in Phantom Operation State After Certificate Resource Deleted

First, take a breath – you’re not alone This is a known quirk with App Service Managed Certificates. You deleted the certificate resource, but Azure’s backend still thinks there’s an ongoing operation (like creation or binding) tied to that domain. The Conflict error is Azure’s way of saying “I’m busy, please wait… but I might be waiting forever.” The good news – there are several ways to snap it out of this state.

1. Give it some time (seriously)

Sometimes the background cleanup just needs 30 – 60 minutes to fully release the lock. Go grab a coffee, check back in an hour. If it’s still stuck, move on.

2. Check the custom domain & TLS settings in the portal

Go to your App Service → Custom domains. See if transfer.sundance-inc.net is still listed, and what its SSL binding status is (e.g., “No binding” or something else).

Then go to TLS/SSL settings → Managed certificates. Look for any pending or failed certificate entries for that domain – if they’re there, try to delete them from the portal directly.

3. Use Azure Resource Explorer for a “hard delete”

This is often the quickest fix. Resource Explorer lets you see and delete leftover resources that the portal hides.

Go to Azure Resource Explorer.

At the top, switch to Read/Write mode.

Navigate to: Subscriptions → your subscription → resourceGroups → your resource group → providers → Microsoft.Web → certificates.

Look for any certificate that looks like transfer.sundance-inc.net-SundanceTransfer. Select it and click Delete (top bar). If it’s gone from the portal but still here, this will finally remove it.

4. Remove and re‑add the custom domain

This forces a fresh certificate creation and often clears the stuck state.

In the App Service, go to Custom domains.

Remove transfer.sundance-inc.net (this won’t affect your app’s traffic if you’re not using it).

Wait a few seconds, then re‑add the same domain.

Azure will automatically try to provision a new managed certificate. This usually resets the whole process.

5. Try PowerShell or Azure CLI for a more forceful cleanup

If the portal and Resource Explorer still won’t budge, use the command line.

PowerShell (replace placeholders with your values):

powershell

# Find any leftover certificate resources

Azure CLI:

bash

az resource delete --ids /subscriptions/your-sub-id/resourceGroups/YourRG/providers/Microsoft.Web/certificates/cert-name

6. Check your Access Restrictions (IP whitelists)

Sometimes, if you have IP restrictions enabled on the App Service, they can block Azure’s validation services from completing the certificate challenge. Try temporarily disabling the restrictions, then trigger a new certificate creation (e.g., by re‑adding the domain). Once the certificate is provisioned, you can re‑enable the restrictions.

Bottom line – what to try first?

Wait an hour – cheapest option.

If not resolved, Resource Explorer delete is usually the fastest fix.

If that doesn’t work, remove/re‑add the custom domain.

For stubborn cases, use PowerShell/CLI and check Access Restrictions.

I’ve seen this clear up with step 3 or 4 in most cases. If you’re still stuck after trying these, come back with the exact error message and the current state (e.g., is the domain still listed? is there a binding?) – we’ll dig deeper.

Hang in there – Azure has its moods, but we’ll get it sorted. 😊