microsoft/aspire · error · AzureProvisioningFailureException

Azure provisioning failure with published failure details.

Error message

Azure provisioning failure with published failure details.

What it means

During Key Vault provisioning the controller detected the vault exists only as a soft-deleted tombstone that could not be located. It publishes a synthetic failure detail explaining the situation and throws AzureProvisioningFailureException wrapping the original exception.

Solutions

Choose a different Key Vault name to avoid the reserved soft-deleted name
Purge the soft-deleted vault in its recorded location (az keyvault purge) or wait for retention to expire
Follow the published failure details to locate and recover/purge the tombstone

Example fix

// before
builder.AddAzureKeyVault("my-vault"); // name reserved by soft-deleted vault
// after
builder.AddAzureKeyVault("my-vault-2");

Defensive patterns

Strategy: validation

Validate before calling

// before provisioning, check for reserved soft-deleted vault names:
// az keyvault list-deleted --query "[?name=='my-vault']"

Try / catch

try { await EnsureProvisionedAsync(...); } catch (AzureProvisioningFailureException ex) { /* read ex failure details; purge tombstone or pick a new vault name */ }

Prevention

Check az keyvault list-deleted before reusing a vault name
Use unique vault names per environment/pipeline
Do not delete and recreate vaults with the same name in different regions

When it happens

Trigger: Creating a Key Vault with a name whose soft-deleted tombstone exists in a different region or subscription so the tombstone can't be resolved; retrying provisioning after a vault was deleted and purge-protection prevented real deletion.

Common situations: Name collision with a previously deleted vault; moving a vault across regions while soft-delete retention (7-90 days) is active; CI recreating environments with deterministic vault names.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/512d2820e134f6be. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure/AzureProvisioningController.cs:1982

            // with the same generated name. ARM only reports this conflict once the live vault is already
            // absent, so issue the purge directly rather than starting another delete that can wait on
            // the same tombstone and delay the retry.
            var purged = await PurgeDeletedKeyVaultAsync(
                armClient,
                keyVaultResourceId,
                intent.ResourceName,
                effectiveLocation,
                currentContext.Location,
                allowTimeout: false,
                cancellationToken).ConfigureAwait(false);
            if (!purged)
            {
                var failureDetails = AzureProvisioningFailureDetails.CreateKeyVaultDeletedStateTombstoneNotFound(
                    keyVaultResourceIdentifier.Name,
                    keyVaultResourceId,
                    GetKeyVaultPurgeLocations(effectiveLocation, currentContext.Location));
                await PublishSyntheticProvisioningFailureAsync(model, targetResources, failureDetails).ConfigureAwait(false);
                throw new AzureProvisioningFailureException(failureDetails, ex);
            }

            await ResetResourcesAsync(model, targetResources, preserveOverrides: true, cancellationToken).ConfigureAwait(false);
            return await EnsureProvisionedOrThrowAsync(model, targetResources, cancellationToken).ConfigureAwait(false);
        }
    }

    // Key Vault is special because deleting a vault leaves a location-scoped soft-delete tombstone.
    // A later create with the same vault name can fail until that tombstone is purged, even though
    // the live resource no longer exists. Detect that specific provisioning failure so reprovision
    // can purge the recoverable vault for the same target resource ID and retry once.
    private static bool TryGetKeyVaultSoftDeleteConflictResourceId(Exception exception, out string keyVaultResourceId)
    {
        keyVaultResourceId = string.Empty;
        if (AzureProvisioningFailureDetails.TryCreate(exception, AzureProvisioningFailureDetails.ProvisionOperation) is not { } failure ||
            !string.Equals(failure.ResourceType, KeyVaultVaultResourceType, StringComparisons.AzureResourceType) ||
            string.IsNullOrWhiteSpace(failure.TargetResourceId) ||
            !ResourceIdentifier.TryParse(failure.TargetResourceId, out var parsedResourceId) ||

View on GitHub (pinned to 25830f84bd)