> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-subscription-arm.md).
# Offboard Azure subscription (ARM)
Follow this procedure to offboard a Microsoft Azure subscription scope from Cortex Cloud and cleanly decommission all Cortex Cloud resources from Microsoft Azure. This method is only for cloud instances that were onboarded using the Azure Resource Manager (ARM) method.
### Prerequisites
Before you begin, ensure you meet the following requirements.
#### Tooling requirements
* Azure CLI (version ≥ 2.61)
* jq (JSON processor)
* Bash (version ≥ 4.0)
#### Required Azure permissions
The authenticated session must be run by a user or service principal with the **Owner** role assigned at the subscription scope. This is required to delete role assignments, role definitions, diagnostic settings, and the Cortex resource group.
#### Authentication
Run the following command in your terminal to authenticate:
```
az login
```
## How to offboard an Azure subscription scope - ARM method
{% stepper %}
{% step %}
### Locate your offboarding bundle
Locate the offboarding bundle provided by Cortex Cloud. Navigate to the directory containing these files before proceeding. The bundle contains the following files, which must all be present in the same directory:
File
Description
connectors_azure_arm-<id>.json
The original ARM deployment template used during onboarding
parameters.sh
Connector-specific parameters, including resource_suffix
offboard_subscription_arm.sh
Interactive offboarding script
{% endstep %}
{% step %}
### Run the offboarding script
{% hint style="warning" %}
#### Important
The script must be run from the directory containing `parameters.sh`. Running it from any other directory will cause it to exit with an error.
{% endhint %}
Execute the offboarding script:
```bash
bash offboard_subscription_arm.sh
```
The script is interactive and guides you through each step. When prompted, provide the following inputs:
1. Subscription ID: Enter the Azure subscription ID to offboard, or press **Enter** to use the currently active subscription.
2. Execution mode: Select one of the following:
* `[1] plan` — Dry run. Lists all role definitions, role assignments, diagnostic settings, and the resource group that would be deleted, along with their current status in Azure. No changes are made. After the plan is shown, you are offered the option to proceed with the action.
* `[2] action` — Executes the cleanup immediately, deleting all identified resources.
{% endstep %}
{% step %}
### Review the plan output
If you selected plan mode, review the output carefully. Each resource is listed with one of the following statuses:
* `EXISTS`: The resource is present in Azure and will be deleted when you run the action.
* `DOESN'T EXIST`: The resource has already been removed.
If all resources show `DOESN'T EXIST`, the subscription has already been fully offboarded. The script will offer to delete the ARM deployment records and exit.
If any resources show `EXISTS`, confirm the plan and enter `y` when prompted to proceed with the action.
{% endstep %}
{% step %}
### Confirm resource deletion
When the action runs, the script deletes the following resources in order:
* Custom role assignments created by the ARM template
* Custom role definitions created by the ARM template
* Diagnostic settings created by the template
* The Cortex resource group (`cortex-`)
Review the script output and confirm that all targeted resources are removed.
{% endstep %}
{% step %}
### Verification
After the action completes, the script automatically waits 10 seconds and then runs a verification check to confirm that all resources have been deleted. This verification runs up to three times. If any resources are still detected on a given attempt, the script re-runs the cleanup before verifying again.
You will see one of the following final messages:
* `Verification passed. Offboarding complete.` : This means that all resources have been successfully removed.
* `❌ Verification failed after 3 attempt(s). N issue(s) remain.`: This means that some resources could not be deleted. Inspect the specific resource IDs shown in the verification output and re-run the script manually.
If verification passes, the script prompts you to optionally delete the ARM deployment records from Azure. Enter `y` to remove them or `N` to retain them.
{% endstep %}
{% endstepper %}
### Troubleshooting
**No resource group found, but a failed deployment exists**
If the Cortex resource group is not found, the script checks for a failed ARM deployment. If a failed deployment is detected, it identifies any orphaned role definitions and role assignments that were created before the failure, shows a plan of what would be deleted, and prompts you to confirm cleanup. After cleanup, you are offered the option to delete the failed deployment record.
**Verification fails after the action**
The script automatically re-runs the cleanup and re-verifies up to three times. Transient Azure API delays are the most common cause. If issues persist after three attempts, inspect the remaining resources using the IDs shown in the verification output and re-run the script with mode `[2] action` to trigger another cleanup sweep.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-subscription-arm.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.