{"record":{"id":"54ddbf842f2b0997","repo":"microsoft/aspire","slug":"azure-key-vault-resources-cannot-change-location-because","errorCode":null,"errorMessage":"Azure Key Vault resources cannot change location because soft-deleted vault names remain reserved globally. Use delete, reprovision, or forget state to recover this resource.","messagePattern":"Azure Key Vault resources cannot change location because soft-deleted vault names remain reserved globally\\. Use delete, reprovision, or forget state to recover this resource\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure/AzureProvisioningController.cs","lineNumber":1343,"sourceCode":"        {\n            yield return parentRelationship.Resource;\n        }\n    }\n\n    private static bool IsKeyVaultTarget(DistributedApplicationModel model, string resourceName)\n    {\n        return GetTargetAzureResources(model, resourceName, includeAnnotationParentRelationships: false)\n            .Any(static resource => resource.AzureResource is IAzureKeyVaultResource);\n    }\n\n    private static void ThrowIfKeyVaultLocationChangeTarget(DistributedApplicationModel model, string resourceName)\n        => ThrowIfKeyVaultLocationChangeTarget(GetTargetAzureResources(model, resourceName, includeAnnotationParentRelationships: false));\n\n    private static void ThrowIfKeyVaultLocationChangeTarget(IReadOnlyList<(IResource Resource, IAzureResource AzureResource)> targetResources)\n    {\n        if (targetResources.Any(static resource => resource.AzureResource is IAzureKeyVaultResource))\n        {\n            throw new InvalidOperationException(AzureProvisioningStrings.ChangeResourceLocationKeyVaultUnsupported);\n        }\n    }\n\n    private static void ThrowIfKeyVaultEnvironmentLocationChange(DistributedApplicationModel model, string? currentLocation, string? requestedLocation)\n    {\n        if (string.IsNullOrWhiteSpace(currentLocation) ||\n            string.IsNullOrWhiteSpace(requestedLocation) ||\n            string.Equals(currentLocation, requestedLocation, StringComparisons.AzureLocation))\n        {\n            return;\n        }\n\n        ThrowIfKeyVaultLocationChangeTarget(GetProvisionableAzureResources(model));\n    }\n\n    private static bool TryGetAzureResource(\n        IReadOnlyList<(IResource Resource, IAzureResource AzureResource)> azureResources,\n        IResource target,","sourceCodeStart":1325,"sourceCodeEnd":1361,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure/AzureProvisioningController.cs#L1325-L1361","documentation":"Key Vault resources are blocked from location changes because soft-deleted vault names stay reserved globally; moving to a new location with the same name would conflict with the tombstone. The controller throws preemptively with recovery guidance.","triggerScenarios":"Changing the location on a target containing an IAzureKeyVaultResource; attempting environment-wide location change when a Key Vault is in scope.","commonSituations":"Migrating an app to a new Azure region that includes Key Vault; re-running location change after a vault was soft-deleted in another region.","solutions":["Use the delete flow, then reprovision in the new location","Use 'forget state' to reset the vault's deployment state and reprovision elsewhere","Purge or wait out the soft-delete period, then change location"],"exampleFix":"// before\naspire change-location --resource vault1 --location eastus // blocked\n// after\naspire delete --resource vault1\naspire reprovision --resource vault1 --location eastus","handlingStrategy":"validation","validationCode":"if (targetResources.Any(r => r.AzureResource is IAzureKeyVaultResource)) { /* route to delete/reprovision flow instead of location change */ }","typeGuard":"bool IsKeyVault(IAzureResource r) => r is IAzureKeyVaultResource;","tryCatchPattern":"try { await ChangeLocationAsync(...); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"Key Vault\")) { /* use delete + reprovision or forget-state */ }","preventionTips":["Never attempt location changes on Key Vault resources; recreate instead","Understand soft-delete reservation rules before renaming or moving vaults"],"tags":["azure","key-vault","location","soft-delete"],"backgroundTag":"unsupported-operation","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}