Skip to main content

204052 - Failed to Delete an NSG Rule

Agent error code #204052 indicates that az network nsg rule delete failed while revoking a grant. Access that should have been withdrawn may still be in place.

Common causes include:

  • The service principal can create rules but not delete them
  • A resource lock on the resource group blocks the deletion
  • Another process changed the NSG at the same time, so the write conflicted
  • The agent host could not reach the Azure management API for the duration of the call

Steps to Resolve

Confirm Whether the Rule Is Still There

  1. In the Azure portal, open the NSG > Inbound security rules
  2. Look for the kk- rule holding the address from the failed revoke
  3. Treat a rule that is still present as live access until it is gone

Remove the Rule by Hand if It Remains

sudo -u knocknoc az network nsg rule delete \
  --resource-group <resource-group> --nsg-name <nsg-name> --name <rule-name>

Confirm the Delete Permission

A custom role granting securityRules/write without securityRules/delete produces exactly this pattern: grants succeed and revokes fail. Network Contributor covers both.

Check for a Resource Lock

A Delete or ReadOnly lock on the NSG or its resource group prevents removal while still allowing some reads. Open the resource group > Locks to check.

Check It Clears on a Later Attempt

A failed revoke is retried automatically. If this code keeps appearing for the same address, remove the rule by hand rather than waiting.

Back to top