Skip to content

Subscription Decommissioning

Subscriptions are easy to create and easy to forget. A subscription nobody owns keeps costing money, keeps access that nobody reviews, and can hold data nobody knows about. Decommissioning retires a subscription deliberately. Its data is kept or deleted on purpose, access is removed, and the Terraform, GitLab and Entra ID pieces that vending created are cleaned up.

Status: planned

The mg-decommissioned management group exists. This process has not yet been run.

Stages

flowchart LR
    A["1. Decide<br/>and announce"] --> B["2. Freeze"]
    B --> C["3. Move to<br/>mg-decommissioned"]
    C --> D["4. Hold<br/>(30 days)"]
    D --> E["5. Cancel and<br/>clean up"]

1. Decide and announce

  • The workload owner confirms the workload is retired and nothing depends on it. Check DNS records, private endpoints, peering and shared identities.
  • Decide what happens to the data: export it, delete it, or keep it for a retention period. Keep the decision in the MR.

2. Freeze

  • Remove team members' access through the subscription's groups. Leave only the platform team and the reader group.
  • Pause the workload's GitLab pipeline, and archive its GitLab project.
  • Export any data that must be kept.

3. Move to mg-decommissioned

An MR to subscription vending changes the subscription's management group to mg-decommissioned. Only Reader roles apply there. It stays visible to governance tooling, but nobody can change it.

4. Hold

Leave the subscription for 30 days. If nobody reports a missing dependency, go ahead. If someone does, move it back. Nothing has been deleted yet.

5. Cancel and clean up

  1. Cancel the subscription. Azure keeps a cancelled subscription for a period (typically 90 days) before deleting it for good, and it can be reactivated during that time.
  2. Remove its entry from subscription vending and apply. This removes the Entra ID groups, the pipeline service principal and its federated credential, and the role assignments that vending created.
  3. State: keep the final state file in the state container for the retention period, then delete the container.
  4. Remove DNS records and any network allocations (the IP range goes back to the address plan, marked as free).
  5. Update the FinOpsId mapping to record that the workload is closed.

Checklist

  • Owner confirms retirement, and dependencies are checked
  • Data decision recorded, and data exported if needed
  • Team access removed and GitLab project archived
  • Moved to mg-decommissioned
  • 30-day hold completed with no issues
  • Subscription cancelled
  • Vending entry removed: groups, service principal and role assignments deleted
  • State kept, DNS records removed, IP range released