Microsoft Azure offboarding overview ↗
When you delete an Azure cloud instance from Cortex XSIAM, the cloud instance is removed from the platform. However, the Azure resources created during onboarding, including role assignments, role definitions, diagnostic settings, deployment stacks, resource groups, and managed identities, remain in your Azure environment until you explicitly clean them up.
The offboarding method depends on two factors:
- The scope at which the cloud instance was onboarded (subscription, management group, tenant, or tenant with Entra ID only).
- The template type used during onboarding (ARM or Terraform).
Use the table below to identify the correct offboarding procedure for your Microsoft Azure cloud instance.
| Onboarding scope | Template type | Procedure |
|---|---|---|
| All scopes | Terraform | Offboard Terraform-based Azure deployments (all scopes) |
| Subscription | ARM | Offboard Azure subscription (ARM) |
| Management group or tenant | ARM | Offboard Azure management group or tenant scope (ARM) |
| Tenant (Entra ID only) | ARM | Offboard Azure tenant with Entra ID only |