Disable-AzRecoveryServicesBackupProtection pretends the vault is immutable when it's not

TiTi commented 8 months ago

Description

Disable-AzRecoveryServicesBackupProtection says my vault is immutable when it's not!

Disable-AzRecoveryServicesBackupProtection: The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States

Issue script & Debug output

$RecoverySVName = "infra-dev-vault"
$RecoverySVResourceGroupName = "rg-infra-dev"
$targetVaultId = (Get-AzRecoveryServicesVault -ResourceGroupName $recoverySVResourceGroupName -Name $RecoverySVName).Id
$bkpItem = Get-AzRecoveryServicesBackupItem -BackupManagementType AzureVM -WorkloadType AzureVM -Name S0103954ocsi1a -VaultId $targetVaultId
Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -VaultId $targetVaultId -RetainRecoveryPointsAsPerPolicy -Force

Got this error:

Disable-AzRecoveryServicesBackupProtection: The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States

Environment data

Name                           Value
----                           -----
PSVersion                      7.4.1
PSEdition                      Core
GitCommitId                    7.4.1
OS                             Microsoft Windows 10.0.22000
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.15.1                Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzConte…
Script     7.1.1                 Az.Compute                          {Add-AzImageDataDisk, Add-AzVhd, Add-AzVMAddition…
Script     7.4.0                 Az.Network                          {Add-AzApplicationGatewayAuthenticationCertificat…
Script     6.7.1                 Az.RecoveryServices                 {Add-AzRecoveryServicesAsrReplicationProtectedIte…

Error output

RequestId      : 16d21045-8946-455b-b67e-6d8e41253221
Message        : The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The
                 Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn
                 more: https://aka.ms/AB-ImmutableVaults-States
ServerMessage  : UserErrorOperationDeniedOnImmutableItem: The Vault and Bakcup Item is in Immutable state where
                 destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is
                 denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States
                 (System.Collections.Generic.List`1[Microsoft.Rest.Azure.CloudError])
ServerResponse : {BadRequest}
RequestMessage : {PUT https://management.azure.com/subscriptions/<subscriptionid>/resourceGroups/rg
                 -infra-dev/providers/Microsoft.RecoveryServices/vaults/infra-dev-vault/backupFabrics/Azure/protectionC
                 ontainers/IaasVMContainer%3Biaasvmcontainerv2%3B<rg>%3BS0103954ocsi1a/protectedItems/VM%
                 3Biaasvmcontainerv2%3B<rg>%3BS0103954ocsi1a?api-version=2023-04-01}
InvocationInfo : {Disable-AzRecoveryServicesBackupProtection}
Line           :         Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -VaultId $targetVaultId
                 -RetainRecoveryPointsAsPerPolicy -Force

Position       : At C:\Git\Remove-NxAzVM.ps1:94 char:9
                 +         Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -Va …
                 +         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
StackTrace     :    at Microsoft.Azure.Management.RecoveryServices.Backup.ProtectedItemsOperations.CreateOrUpdateWithHt
                 tpMessagesAsync(String vaultName, String resourceGroupName, String fabricName, String containerName,
                 String protectedItemName, ProtectedItemResource parameters, Dictionary`2 customHeaders,
                 CancellationToken cancellationToken)
HistoryId      : 9