Diagnose: Deployment 409 Conflict: resource exists with different immutable properties

TL;DR: Symptom: Deployment 409 Conflict: resource exists with different immutable properties Cause: Re-running a template 409s because a property that cannot change after creation differs (SKU family, Cosmos DB capabilities, some network settings), or a soft-deleted resource still holds the name. Not the full reference manual. CONFIRM IT CONFIRM: az deployment group show --name [d] -g [rg] --query properties.error.details names the conflicting property; what-if shows the template trying to change it. FIX FIX: immutable property: revert the template to the existing value, or recreate the resource...

The error

Deployment 409 Conflict: resource exists with different immutable properties Cause: Re-running a template 409s because a property that cannot change after creation differs (SKU family, Cosmos DB capabilities, some network settings), or a soft-deleted resource still holds the name. CONFIRM IT CONFIRM

The fix

TL;DR: Symptom: Deployment 409 Conflict: resource exists with different immutable properties Cause: Re-running a template 409s because a property that cannot change after creation differs (SKU family, Cosmos DB capabilities, some network settings), or a soft-deleted resource still holds the name. CONFIRM IT CONFIRM: az deployment group show --name [d] -g [rg] --query properties.error.details names the conflicting property; what-if shows the template trying to change it. FIX FIX: immutable property: revert the template to the existing value, or recreate the resource deliberately (backup data first).

The fix

SYMPTOM Deployment 409 Conflict: resource exists with different immutable properties

CONFIRM IT CONFIRM: az deployment group show --name [d] -g [rg] --query properties.error.details names the conflicting property; what-if shows the template trying to change it. For name-held: the resource appears in soft-deleted listings (e.g. az keyvault list-deleted).

FIX FIX: immutable property: revert the template to the existing value, or recreate the resource deliberately (backup data first). Soft-deleted name: purge it (az keyvault purge) or wait out retention. Never script delete-then-create on stateful resources as conflict resolution.

VERIFY VERIFY: what-if shows no changes, deployment reports Succeeded.

When to use this

• This covers exactly what the title says: Diagnose.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Diagnose; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Diagnose behavior.

Why it happens

CAUSE Re-running a template 409s because a property that cannot change after creation differs (SKU family, Cosmos DB capabilities, some network settings), or a soft-deleted resource still holds the name.

Also seen as

• az deployment group show --name [d] -g [rg] --query properties.error.details

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/overview