Teardown & Cleanup

Quick Teardown (Resource Groups Only)

Delete all resource groups but keep the management group and policies:

Note

Replace swc with gwc if you deployed to germanywestcentral, and replace prod with your environment name (dev or staging) if different.

for rg in rg-hub-smb-swc rg-spoke-prod-swc rg-monitor-smb-swc rg-backup-smb-swc rg-migrate-smb-swc rg-security-smb-swc; do
  az group delete --name "$rg" --yes --no-wait
done

Wait for completion:

for rg in rg-hub-smb-swc rg-spoke-prod-swc rg-monitor-smb-swc rg-backup-smb-swc rg-migrate-smb-swc rg-security-smb-swc; do
  az group wait --name "$rg" --deleted 2>/dev/null
done

Also delete the budget (subscription-scoped, not in any RG):

az consumption budget delete --budget-name budget-smb-monthly

Full Cleanup Script

The Remove-SmbReadyFoundation.ps1 script handles complete cleanup:

cd infra/bicep/smb-ready-foundation

# Preview what will be deleted (dry run)
pwsh scripts/Remove-SmbReadyFoundation.ps1 -WhatIf

# Delete everything except management group
pwsh scripts/Remove-SmbReadyFoundation.ps1 -Force

# Delete everything including management group
pwsh scripts/Remove-SmbReadyFoundation.ps1 -Force -RemoveManagementGroup

The script removes:

• 6 resource groups (with all contained resources)
• Subscription-scoped budget
• MG-scoped and subscription-scoped policy assignments
• Management group itself (with -RemoveManagementGroup)

Selective Cleanup

Remove only hub networking

az group delete --name rg-hub-smb-swc --yes  # replace swc with your region abbreviation

Remove only the spoke

az group delete --name rg-spoke-prod-swc --yes  # replace prod/swc as needed

Remove policies only

# List current assignments
az policy assignment list \
  --scope "/providers/Microsoft.Management/managementGroups/smb-rf" \
  --query "[].{name:name, displayName:properties.displayName}" -o table

# Delete a specific policy
az policy assignment delete \
  --name smb-compute-01 \
  --scope "/providers/Microsoft.Management/managementGroups/smb-rf"

Cleanup Between Scenario Tests

When switching scenarios, delete resource groups and budget but keep the MG and policies:

1. Delete resource groups (parallel, async)
2. Wait for deletions
3. Delete budget
4. Configure new scenario with azd env set SCENARIO <new-scenario>
5. Deploy with azd up

Caution

Resources with delete locks (Key Vault soft delete, Recovery Services Vault) may require manual intervention. Check the Azure Portal if deletions appear stuck.

azd Environment Cleanup

Remove azd environment state (local only — does not delete Azure resources):

azd env select my-environment
azd env delete --force

List all environments:

azd env list

Discover an Existing Deployment

If you’re cleaning up a deployment you didn’t create, discover the deployed resources first:

# Find SMB Ready Foundation resource groups
az group list --query "[?starts_with(name,'rg-') && (contains(name,'smb') || contains(name,'spoke'))].{name:name, location:location}" -o table

# Check if the management group exists
az account management-group show --name smb-rf 2>/dev/null && echo "MG exists" || echo "No MG"

# Count policy assignments
az policy assignment list --scope "/providers/Microsoft.Management/managementGroups/smb-rf" --query "length(@)" 2>/dev/null