Teardown — Dev (Ollama) Agent on Azure Container Apps (AI-Led)

Reverses the deploy-agent-aca-dev skill. Deletes the Azure resource group and (opt-in) the Entra objects.

Paired with: deploy-agent-aca-dev. Uses the same /tmp/deploy-vars.sh.

When to Use

• User says: "tear down the dev ACA deployment", "delete the Ollama agent on Azure", "clean up the demo RG"
• User wants to re-run the deploy skill from a clean state
• User is ending a demo and needs to remove billable resources (ACA, ACR with Ollama images, Log Analytics)

Do NOT Use When

• Local docker-compose — cd sidecar/dev && docker compose down -v is enough
• AWS variant — use teardown-agent-aca-aws (handles IAM role, OIDC provider, intermediary app)
• Shared / long-lived tenants — confirm the Blueprint and Client SPA are not shared with other agents first

Safety posture

1. Dry-run by default (DRY_RUN=1). User must set DRY_RUN=0 to actually delete.
2. Entra objects are opt-in (DELETE_ENTRA=1). Default keeps them.
3. Confirm tenant + subscription + RG with the user first — the user has multiple Azure accounts.
4. Re-confirm before deleting the Blueprint. Blueprints are often shared.

Prerequisites

• /tmp/deploy-vars.sh from the original deployment (at minimum SUBSCRIPTION_ID, RG).
• az logged in to the correct tenant + subscription.
• Graph role sufficient to delete Entra apps (only if DELETE_ENTRA=1): Application Administrator or higher.

Procedure

Step 0 — Confirm scope

Teardown plan (dev / Ollama):
  Subscription:  $SUBSCRIPTION_ID
  Resource group: $RG            (WILL be deleted)
  Delete Entra objects: $DELETE_ENTRA
  Dry run:              $DRY_RUN
Proceed? [y/N]

Step 1 — Revoke OAuth consent grants on the Agent SP

If keeping the Agent Identity, revoke existing consent so a redeploy starts clean:

AGENT_SP_OID=$(az ad sp show --id "$AGENT_CLIENT_ID" --query id -o tsv 2>/dev/null)
if [[ -n "$AGENT_SP_OID" ]]; then
  az rest --method GET \
    --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants?\$filter=clientId eq '$AGENT_SP_OID'" \
    --query 'value[].id' -o tsv | while read -r g; do
      az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/$g"
  done
fi

Step 2 — Delete the resource group

az group delete --name "$RG" --yes --no-wait

This removes the Container App, ACA environment, ACR (with the ~1–4 GB baked Ollama image), Log Analytics workspace, and user-assigned managed identity in one shot.

Step 3 — Delete Entra objects (opt-in: DELETE_ENTRA=1)

Ask per object. Order:

1. Client SPA (CLIENT_SPA_APP_ID) — safe if no other agent reuses it.
2. Agent Identity — delete via Agent ID portal or Graph (DELETE /agentIdentities/{id}).
3. Blueprint (BLUEPRINT_APP_ID) — ASK AGAIN. Blueprints are often shared.

az ad app delete --id "$CLIENT_SPA_APP_ID" 2>/dev/null || true
# Agent + Blueprint: prompt explicitly, then call Graph

Step 4 — Verify

az group exists --name "$RG"                          # expect: false
az ad app show --id "$CLIENT_SPA_APP_ID" 2>&1 | head -1   # expect: not found (if DELETE_ENTRA=1)

Orchestrator

Single-entry-point script: scripts/teardown-aca-dev.sh.

# Dry run (default)
bash .claude/skills/teardown-agent-aca-dev/scripts/teardown-aca-dev.sh

# Real teardown, Azure only
DRY_RUN=0 bash .claude/skills/teardown-agent-aca-dev/scripts/teardown-aca-dev.sh

# Full teardown (incl. Entra apps)
DRY_RUN=0 DELETE_ENTRA=1 \
  bash .claude/skills/teardown-agent-aca-dev/scripts/teardown-aca-dev.sh

Common failure modes

References

• Azure — delete resource group
• Microsoft Graph — oauth2PermissionGrants