**TL;DR:** Symptom: Deployment 409 Conflict: resource exists with different immutable properties Cause: Re-running a template 409s because a property that cannot change after creation differs (SKU family, Cosmos DB capabilities, some network settings), or a soft-deleted resource still holds the name. Not the full reference manual. CONFIRM IT CONFIRM: az deployment group show --name [d] -g [rg] --query properties.error.details names the conflicting property; what-if shows the template trying to change it. FIX FIX: immutable property: revert the template to the existing value, or recreate the resource...

## The error

```text
Deployment 409 Conflict: resource exists with different immutable properties Cause: Re-running a template 409s because a property that cannot change after creation differs (SKU family, Cosmos DB capabilities, some network settings), or a soft-deleted resource still holds the name. CONFIRM IT CONFIRM
```

## The fix

**TL;DR:** Symptom: Deployment 409 Conflict: resource exists with different immutable properties Cause: Re-running a template 409s because a property that cannot change after creation differs (SKU family, Cosmos DB capabilities, some network settings), or a soft-deleted resource still holds the name. CONFIRM IT CONFIRM: az deployment group show --name [d] -g [rg] --query properties.error.details names the conflicting property; what-if shows the template trying to change it. FIX FIX: immutable property: revert the template to the existing value, or recreate the resource deliberately (backup data first).

## The fix

SYMPTOM
Deployment 409 Conflict: resource exists with different immutable properties

CONFIRM IT
CONFIRM: `az deployment group show --name [d] -g [rg] --query properties.error.details` names the conflicting property; what-if shows the template trying to change it. For name-held: the resource appears in soft-deleted listings (e.g. `az keyvault list-deleted`).

FIX
FIX: immutable property: revert the template to the existing value, or recreate the resource deliberately (backup data first). Soft-deleted name: purge it (`az keyvault purge`) or wait out retention. Never script delete-then-create on stateful resources as conflict resolution.

VERIFY
VERIFY: what-if shows no changes, deployment reports Succeeded.

## When to use this

- This covers exactly what the title says: Diagnose.
- You are setting this up for the first time, or auditing an existing setup.
- You want the key gotchas in one place before you start.

## When not to use this

- You are doing a different workflow with Diagnose; these steps are specific to the title above.
- You need the full reference docs; this is the short path, not the manual.

## Compatibility

- Not pinned to a specific version; follows current Diagnose behavior.

## Why it happens

CAUSE
Re-running a template 409s because a property that cannot change after creation differs (SKU family, Cosmos DB capabilities, some network settings), or a soft-deleted resource still holds the name.

## Also seen as

- `az deployment group show --name [d] -g [rg] --query properties.error.details`