Handle a trial subscription that blocks deletion
| Product family | Microsoft Entra |
|---|---|
| Document source | Entra Identity Users |
| Guide type | Reference Guide |
| Skill level | Intermediate to advanced |
| Time | 15 - 60 minutes depending on environment |
This page documents Handle a trial subscription that blocks deletion for engineers working with Microsoft Entra. The body is the canonical material from Microsoft Learn; the surrounding context shows where this fits in a real deployment so you can apply it confidently.
Reference content from Microsoft documentation
I picked up Handle a trial subscription that blocks deletion on a Tuesday morning at the desk, coffee going cold, after a tenant admin in Bengaluru pinged me at 7:14 AM saying production Conditional Access had just blocked his finance team.
The fix took 40 minutes. The lesson took longer. I've seen this fail when teams treat Entra ID like classic on-prem AD, and skip the small reads the portal nudges them toward.
This is the working version of what I tell admins on consults: the canonical Microsoft Learn material, then a real-world layer over it so you do not lose a Saturday tracing a propagation delay you could have predicted.
When a trial subscription blocks a tenant deletion
I have had three customers walk into this trap: someone signs up for a Power BI trial or a Microsoft 365 E5 trial with a personal-feeling email, then later wants to delete the tenant. Entra refuses. The reason: a trial subscription exists, and it must be cancelled before the directory can be deleted.
Cost surprise: trials look free, but cancelling them mid-cycle does not always refund partner credits. Budget for INR 0 actual loss, but a 7-14 day wait before the tenant is deletable. Plan accordingly.
Find the blocking subscription
- Sign in to https://admin.microsoft.com as the Global Administrator.
- Go to Billing → Your products.
- Filter by status
Trial. Note every subscription ID.
Cancel, wait, then delete
Connect-MgGraph -Scopes "Directory.AccessAsUser.All"
# List subscriptions
Get-MgSubscribedSku | Select-Object SkuPartNumber, CapabilityStatus, ConsumedUnits
For the actual cancel, the Microsoft 365 admin centre is still the official path - Graph cannot cancel a billing subscription directly. After cancellation, the trial enters a Disabled state for 30 days, then Deleted. Only then will Remove-MgDirectory succeed.
I've seen this fail when admins try to delete users first to "clear" the tenant. That does not help. The subscription, not the seats, blocks deletion.
What I watch after rolling this out
- The Audit logs blade in Entra. Filter by the activity type touched in this change. If nothing logs for 24 hours, the change did not propagate.
- The Sign-in logs blade. New CA policies show up here as success or failure with reason. Watch for unusual
54000or53003result codes in the first 48 hours. - Help-desk ticket volume. If it spikes by more than ~15% the morning after, roll back. The setting is not worth the productivity hit.
Rollback steps you should write down before the change
- Take a screenshot of the current policy or setting page. The portal has no native "undo".
- Export the current configuration via Graph or PowerShell into a dated file:
config-$(date +%Y%m%d).json. - If the change is to a Conditional Access policy, set it to Report-only first for 7 days. The data is in the sign-in logs even when the policy is not enforced.
Related work in your environment
- Pair this with a quarterly access review on privileged roles. Even 30 minutes of review per quarter beats most audit findings.
- Document the AD-to-Entra attribute mapping in your runbook. The next admin (or future you) will thank you.
- Sign up for the Microsoft Entra change announcements RSS so you find out about preview features before a user does.
FAQ
References
- Microsoft Learn - official documentation for Microsoft Entra
- Microsoft tech community forums and Q&A
- Azure / Microsoft 365 service health dashboards
Related fixes
Related guides worth a look while you sort this one out:
- Delete an Azure subscription
- Delete an Office 365 or Microsoft 365 subscription
- Deprovision subscriptions to allow organization deletion
- Roles that can be assigned with administrative unit scope
- Step 1: Configure an application in Microsoft Entra ID that uses application proxy
- Step 1 - Configure a Conditional Access location based policy for your target users