Last Updated on August 11, 2025 by Arnav Sharma
Here’s an easy way to clean up Azure Subscription and delete all resource groups, plus resources to save some credits.
Step 1 is to create a resource group named ‘automation’ (or change the name in the script below) and create an automation account. Ensure that the “System Assigned” identity is checked while account creation.

Step 2, go to Subscription and enable contributor access for the automation account.

Step 3, Go to the Automation account and click on runbook and create a new account.

Step 4, paste the PowerShell script here and hit Save, followed by Publish

Step 5, click on start to test the script or in case you want to schedule it, click on Schedules inside the runbook and add a schedule as per your requirement.

The automation account has contributor access on the Sub., so when the runbook will trigger at a specific time, it will clean off all resource groups and resources.
Script:
# Ensures you do not inherit an AzContext in your runbook
Disable-AzContextAutosave -Scope Process
# Connect to Azure with system-assigned managed identity
$AzureContext = (Connect-AzAccount -Identity).context
# set and store context
$AzureContext = Set-AzContext -SubscriptionName $AzureContext.Subscription -DefaultProfile $AzureContext
Write-Output "Using system-assigned managed identity"
#Get Azure Resource Groups
$allresourcegroups = Get-AzResourceGroup | Where-Object ResourceGroupName -NotLike '*automation*' ##exception is set here
if(!$allresourcegroups){
Write-Output "No resource groups found";
}
else{
Write-Output "Starting the cleanup process";
foreach($resourceGroup in $allresourcegroups){
$rgname = $resourceGroup.ResourceGroupName
Write-Host "Deleting $($resource.ResourceGroupName)..."
Remove-AzResourceGroup -Name $rgname -Force
}
Write-Output "Cleanup Completed";
}
I help organisations secure their cloud infrastructure and stay ahead of evolving cyber threats. Microsoft MVP and Certified Trainer, author of Mastering Azure Security, and founder of arnav.au — a platform for practical Cloud, Cybersecurity, DevOps and AI content.
Frequently Asked Questions
The 'automation' resource group is created to house the Azure Automation Account that will run the cleanup script. This resource group is excluded from deletion by the script itself (using the -NotLike '*automation*' filter), ensuring the automation account continues to exist and can perform future cleanup tasks.
System Assigned managed identity allows the automation account to authenticate securely with Azure without storing credentials in the runbook. This identity is used in the PowerShell script to connect to Azure using 'Connect-AzAccount -Identity', making the process more secure and easier to manage.
Enabling contributor access grants the automation account the necessary permissions to delete all resource groups and their associated resources across the entire subscription. Without these permissions, the runbook would fail when attempting to remove resource groups.
After publishing the runbook, navigate to the Schedules option within the runbook settings and add a new schedule with your desired frequency and time. Once created, the runbook will automatically trigger at the specified times and clean up resources without manual intervention.
The script uses the filter 'Where-Object ResourceGroupName -NotLike '*automation*'' to prevent deletion of the automation resource group itself. This exclusion ensures the automation account and runbook remain intact and can continue to be used for future cleanup operations.