Azure AI Services: account stuck in non-terminal "Accepted" provisioning state after its CMK key vault and managed identity were deleted — delete fails with RequestConflict, needs backend clear

Summary

An AIServices account is permanently stuck in provisioningState: Accepted and cannot be deleted. I have already performed every self-service remediation I can find, including recovering the key vault and key it lost. The account is now deadlocked: its stored CMK identity reference is invalid, and it cannot be corrected because the non-terminal state rejects every write. I believe this requires a backend clear of the provisioning state by the product group.

Resource

• Kind: AIServices, SKU S0, region westeurope
• The account has no deployments and no projects. Deleting it is safe.

I have withheld the subscription and resource IDs from this public post. I can provide the full resource ID, subscription ID, and identity object IDs privately as soon as someone picks this up — just ask and I will supply them.

Names are referred to below as:

• ACCOUNT — the stuck AIServices account
• VAULT — the key vault that held its customer-managed key
• KEY — the CMK inside that vault
• OLD_IDENTITY — the original user-assigned managed identity (deleted)
• NEW_IDENTITY — a replacement UAMI I created at the identical resource ID

How it got into this state

The account was CMK-encrypted against VAULT and OLD_IDENTITY.

Both of those were destroyed by a terraform destroy while the account itself was not managed by that Terraform state. The account immediately went to provisioningState: Failed.

Symptoms

Delete failed identically through every channel:

• az cognitiveservices account delete → HTTP 500 InternalServerError (reproduced 5+ times)
• az resource delete → same
• raw DELETE via az rest against api-version=2024-10-01 → same
• az group delete fails on this account for the same reason; the group's only other contents are the account's own CMK dependencies (the recovered vault and its managed identities), which must stay in place for any fix to be possible

Any PATCH was rejected first with CouldNotConnectToKeyVault (vault DNS no longer resolved), and after vault recovery with ManagedIdentityClientIdNotFound for the clientId of OLD_IDENTITY, which is permanently gone and cannot be recreated.

Self-service remediation I already completed

1. Recovered the soft-deleted VAULT.
2. Recovered the soft-deleted KEY — restored and enabled at its original version.
3. Recreated NEW_IDENTITY at the identical resource ID as OLD_IDENTITY and granted it Key Vault Crypto Service Encryption User on VAULT. Note that a recreated UAMI necessarily receives a new clientId; the original clientId cannot be reproduced.
4. PATCHed properties.encryption.keyVaultProperties.identityClientId to the new clientId. This returned HTTP 200 with provisioningState: Accepted.

Important: that PATCH never committed. Because the operation never reached a terminal state, properties.encryption.keyVaultProperties.identityClientId still reads the original, permanently-deleted clientId. The vault and key are restored and reachable, but the account's stored CMK identity reference cannot be corrected, because every write is now rejected by the non-terminal state. This is a deadlock: the state will not clear without the identity being valid, and the identity cannot be made valid while the state is non-terminal.

Current state

The account has been stuck in the non-terminal state Accepted for many hours with no transition to Succeeded or Failed.

Delete now returns:

RequestConflict: Cannot modify resource with id '.../accounts/ACCOUNT' because the

resource entity provisioning state is not terminal. Please wait for the

provisioning state to become terminal and then retry the request.

Things I have already ruled out

• Resource locks — az lock list returns empty at every scope.
• Connections — az cognitiveservices account connection list returns [].
• Private endpoints — the account's private endpoint was already deleted.
• Deployments / projects — none.
• Documented CLI workarounds — az resource update --set tags.fix=stuck and az resource delete --no-wait both fail with the same RequestConflict.
• Purging other soft-deleted Cognitive Services accounts — this is the one self-service fix reported to work in a similar thread, where purging deleted resources caused the stuck account to drop to Failed. I purged every soft-deleted Cognitive Services account in this subscription; az cognitiveservices account list-deleted now returns empty. The account remained in Accepted, and an immediate delete retry still returned RequestConflict. This workaround does not apply here.
• Waiting — polled every 60 seconds for hours continuously; no state transition at any point.

Request

Please clear the stuck provisioning state server-side so the account can be deleted. I will provide the subscription and resource IDs privately on request.

Time sensitivity

VAULT is soft-deleted with purge protection enabled, so it cannot be purged early or extended. It is scheduled to auto-purge on 2026-09-20. Once it purges, KEY is permanently unrecoverable and the account's CMK reference can never be satisfied again. Ideally this is resolved before that date.

Note: I do not have a paid support plan, so az support in-subscription tickets create returns InvalidSupportPlan, which is why I am raising it here.