Unable to delete tenant – blocked by Microsoft first-party enterprise apps ("Specified App Principal ID is Microsoft Internal")

When tenant deletion is blocked by first-party Microsoft applications returning the error "Specified App Principal ID is Microsoft Internal", it means you are attempting to remove core Microsoft service principals (such as Exchange, SharePoint, or Microsoft Graph) that cannot be deleted or modified manually.

Here is how to resolve this issue and complete the tenant deletion:

1. Filter Out Microsoft First-Party Service Principals

Instead of attempting to delete all service principals with Get-MgServicePrincipal -All, run PowerShell scripts that specifically target non-Microsoft apps (AppOwnerGroupId exists or Tags don't include Microsoft internal tags):

PowerShell

Connect-MgGraph

2. Check for Hidden or Residual Subscriptions

First-party enterprise apps often stay anchored to a tenant because of residual trial subscriptions, developer plans, or self-service sign-ups (e.g., Power BI Free, Teams Exploratory, or Microsoft 365 Defender):

• Go to the Microsoft 365 Admin Center -> Your products.
• Ensure all free, trial, and self-service licenses are fully canceled and their status shows as Deleted (not just Disabled or Deprovisioned).
• Check Billing -> Licenses to confirm 0 active assignments remain.

3. Check for Subscriptions in Deprovisioning State

If subscriptions were canceled recently, Microsoft keeps the underlying first-party enterprise apps alive during a mandatory data-retention lifecycle window (typically 30–90 days).

• If all readiness checks pass but deletion fails at execution, the backend system is waiting for deleted subscriptions to purge completely.
• You can accelerate this by logging into the Azure Portal -> Cost Management + Billing -> Subscriptions and ensuring no canceled subscriptions exist in a "Deprovisioning" state.

4. Request Backend Purge (Microsoft Support)

If only Microsoft internal service principals remain and all subscriptions/licenses are confirmed deleted:

• Since tenant admins lack permission to remove Microsoft-internal service principals, open a support ticket with Microsoft Entra / Azure Support under the Tenant Management category.
• Provide your Tenant ID (20c3ef89-c150-xxxx-a85d-40c4fb2bf393) and request a backend force-deletion/purge of orphan first-party service principals.When tenant deletion is blocked by first-party Microsoft applications returning the error "Specified App Principal ID is Microsoft Internal", it means you are attempting to remove core Microsoft service principals (such as Exchange, SharePoint, or Microsoft Graph) that cannot be deleted or modified manually. Here is how to resolve this issue and complete the tenant deletion: 1. Filter Out Microsoft First-Party Service Principals Instead of attempting to delete all service principals with Get-MgServicePrincipal -All, run PowerShell scripts that specifically target non-Microsoft apps (AppOwnerGroupId exists or Tags don't include Microsoft internal tags): PowerShell

    Connect-MgGraph
  

  2. Check for Hidden or Residual Subscriptions First-party enterprise apps often stay anchored to a tenant because of residual trial subscriptions, developer plans, or self-service sign-ups (e.g., Power BI Free, Teams Exploratory, or Microsoft 365 Defender):
  • Go to the Microsoft 365 Admin Center -> Your products.
    • Ensure all free, trial, and self-service licenses are fully canceled and their status shows as Deleted (not just Disabled or Deprovisioned).
      • Check Billing -> Licenses to confirm 0 active assignments remain.
  3. Check for Subscriptions in Deprovisioning State If subscriptions were canceled recently, Microsoft keeps the underlying first-party enterprise apps alive during a mandatory data-retention lifecycle window (typically 30–90 days).
  • If all readiness checks pass but deletion fails at execution, the backend system is waiting for deleted subscriptions to purge completely.
    • You can accelerate this by logging into the Azure Portal -> Cost Management + Billing -> Subscriptions and ensuring no canceled subscriptions exist in a "Deprovisioning" state.
  4. Request Backend Purge (Microsoft Support) If only Microsoft internal service principals remain and all subscriptions/licenses are confirmed deleted:
  • Since tenant admins lack permission to remove Microsoft-internal service principals, open a support ticket with Microsoft Entra / Azure Support under the Tenant Management category.
  • Provide your Tenant ID (20c3ef89-c150-xxxx-a85d-40c4fb2bf393) and request a backend force-deletion/purge of orphan first-party service principals.