[BUG] AzureBackup MCP cleanup fails because Backup Vault resources are deleted in the wrong order

[chidozieononiwu]

Describe the Bug

Resources created by AzureBackup MCP tools can leave orphaned resource groups because Azure Backup Vault dependencies require a specific cleanup sequence.

Currently, cleanup attempts can fail when deleting the Backup Vault or Backup Policies because backup instances are still present or are retained in soft-delete state. Azure prevents vault deletion when backup instances or policies still exist.

Required Cleanup Sequence

1. Disable soft delete on the Backup Vault.
2. Delete all Backup Instances.
3. Delete all Backup Policies.
4. Delete the Backup Vault.
5. Delete the Resource Group.

Expected Behavior

AzureBackup MCP tools should clean up backup-related resources in dependency order:

Disable Soft Delete
    ↓
Delete Backup Instances
    ↓
Delete Backup Policies
    ↓
Delete Backup Vault
    ↓
Delete Resource Group

Impact

• Test resource groups are left behind.
• Leaks Azure resources.
• Requires manual cleanup of Backup Vault dependencies.
• Causes repeated failures in automated test and validation scenarios.

Acceptance Criteria

• Cleanup logic disables soft delete before resource deletion.
• All backup instances are removed before policy deletion.
• All backup policies are removed before vault deletion.
• Resource group deletion succeeds without manual intervention.
• Re-running cleanup is idempotent and succeeds even when some resources have already been removed.

Actual Behavior

Resource group cleanup attempts to delete the Backup Vault before dependencies are removed.
Backup Vault deletion fails with:

Cannot delete the Backup vault as there are existing backup instances or backup policies in the vault.

Reproduction Steps

• Run BuildJob for Live tests - tools/Azure.Mcp.Tools.AzureBackup

[github-actions]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @microsoft/azure-mcp.