> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-terraform-based-azure-deployments-all-scopes.md). # Offboard Terraform-based Azure deployments (all scopes) Follow this procedure to offboard all Terraform-based Microsoft Azure scopes (subscription, management group, or tenant) and cleanly decommission all Cortex Cloud resources from Microsoft Azure. Fo ### Prerequisites Before you begin, ensure you meet the following requirements: #### Tooling requirements * Bash (version $$\ge$$ 4.0) * Azure CLI (version $$\ge$$ 2.61) * jq (JSON processor) * Terraform CLI (initialized in your Cortex deployment directory) #### Required Azure permissions The authenticated session must be run by a user or service principal with the **Owner** role assigned at the management group scope. This is required to delete policy resources, role assignments, role definitions, and resource groups across all child subscriptions. #### Authentication Run the following command in your terminal to authenticate with the correct Azure tenant: ```bash az login --tenant ``` ## How to offboard Microsoft Azure {% tabs %} {% tab title="Azure subscription scope" %} 1. In the same Terraform directory used to deploy, run the destruction command. This removes all core Terraform-managed resources, including the deployment stack, onboarding resource group, managed identity, and diagnostic settings: ```bash terraform destroy ``` 2. Review the destruction plan carefully, then enter `yes` to confirm the removal. {% endtab %} {% tab title="Azure MG or tenant scope" %} ### 1. Identify `ext_resource_suffix` {% hint style="warning" %} #### Important This step must be performed before destroying any resources. Once `terraform destroy` is executed, the Terraform state is cleared, and this value cannot be recovered without contacting Palo Alto Networks support. {% endhint %} 1. In your local terminal within the directory containing your Cortex Cloud Terraform configuration and run the following command to retrieve the unique resource suffix: ```bash terraform output ext_resource_suffix ``` 2. Copy and save the output string. It is referred to as `` in the steps below. ### 2. Run `terraform destory` This removes all core Terraform-managed resources, including the deployment stack, onboarding resource group, managed identity, diagnostic settings, and Graph API roles. 1. In the same Terraform directory used in Step 1, run the destruction command: ```bash terraform destroy ``` 2. Review the destruction plan carefully, then enter `yes` to confirm the removal. ### 3. Run `offboard_policy_deployment.sh` Certain policy-deployed resources are created per-subscription by a `deployIfNotExists` policy and exist outside the Terraform lifecycle, so `terraform destroy` cannot remove them. The `offboard_policy_deployment.sh` script must be executed to finalize the offboarding. For your reference, the following flags are used in the script:
FlagDescription
--management-group-id <id>

Required. Scope-specific values for --management-group-id:

  • Subscription scope: Pass the management group ID that contains the subscription being offboarded.
  • Management group scope: Pass the specific management group ID being offboarded.
  • Tenant scope: Pass the tenant-root management group ID.
--ext-resource-suffix <ext-value>Required. The suffix value saved from Step 1.
--no-dry-runAction Flag. By default, the script runs in read-only mode. You must pass this flag to execute actual resource deletions.
--yes or -yAutomation Flag. Skips the interactive confirmation prompt. (Required for CI/CD pipelines, ignored in dry-run mode).
1. First run a dry-run to preview the planned deletions and ensure your permissions are correct: ```bash bash offboard_policy_deployment.sh \ --management-group-id \ --ext-resource-suffix ``` 2. Review the script output and confirm that all targeted resources were removed. The script runs a post-deletion verification phase automatically. A final summary is printed to the terminal indicating the outcome of each phase.\ If the script exits with a non-zero code or reports leftover resources in the verification phase, it is usually due to transient Azure API delays. You can safely re-run the script with `--no-dry-run` to trigger another cleanup and verification sweep. 3. After reviewing the dry-run output, run the script with `--no-dry-run` to delete the resources: ```bash bash offboard_policy_deployment.sh \ --management-group-id \ --ext-resource-suffix \ --no-dry-run ``` {% endtab %} {% endtabs %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-terraform-based-azure-deployments-all-scopes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.