Failed to Delete Restore Point for Azure VM

I recently had to delete a restore point for a VM in Azure, which failed for an unknown reason.

Looking at the restore point, I noticed it had a Failed status. When trying to delete the restore point using the Remove-AzRestorePoint PowerShell command, I got a clearer error description:

Remove-AzRestorePoint: Long running operation failed with status 'Failed'. Additional Info:'There is an active shared access signature outstanding for disk restore point <servername>_OsDisk_1_<xxx>. Call EndGetAccess before deleting the VM restore point AzureBackup_20250705_010355.'
ErrorCode: DiskRestorePointUsedByCustomer
ErrorMessage: There is an active shared access signature outstanding for disk restore point <servername>_OsDisk_1_<xxx>. Call EndGetAccess before deleting the VM restore point AzureBackup_20250705_010355.
ErrorTarget:
StartTime: 2025-07-06 14:06:39
EndTime: 2025-07-06 14:06:40
OperationID: 3d3529f5-32cd-4db8-9631-dde801dccc12
Status: Failed

The error indicates that the backup service still has a lock on the disk (a so called SAS, or Shared Access Signature), which makes it impossible to delete the restore point. The soultion is apperently to call the EndGetAccess API endpoint. From here, I used my Google and AI skills for several hours before I finally found out the right API call to do to release the lock and further the restore point. To spare you the same ammount of hours I spent, I’m going to share the commands I used.

To continue, you need the following information:

• Subscription ID
• Backup Resource Group Name (e.g., AzureBackupRG_<zone>_<n>)
• Restore Point Collection Name (e.g., AzureBackup_<servername>_<nnn>)
• Restore Point Name (e.g., AzureBackup_20250705_010355)
• Disk Restore Point Name (e.g., <servername>_OsDisk_1_<xxx>)

Then you need to make sure you have Azure CLI installed, and that you are signed in using an admin account. Also mak sure to select the right subscription.

# Login
Connect-AzAccount

# Set variables
$subscriptionId = ""
$resourceGroupName = ""
$restorePointCollectionName = ""
$restorePointName = ""
$diskRestorePointName = ""
$apiVersion = "2024-03-02"

# Get access token
$token = az account get-access-token --resource=https://management.azure.com --query accessToken -o tsv

# Construct REST API URL
$url = "https://management.azure.com/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Compute/restorePointCollections/$restorePointCollectionName/restorePoints/$restorePointName/diskRestorePoints/$diskRestorePointName/endGetAccess?api-version=$apiVersion"

# Make POST request
$response = Invoke-RestMethod -Method Post -Uri $url -Headers @{
    Authorization = "Bearer $token"
    "Content-Type" = "application/json"
}
$response

Now, we have called the EndGetAccess API endpoint to release the lock. From here, you should be able to delete the restore point as per usual in the Azure portal.

Happy backuping!