Cannnot delete tenant

You cannot delete the “Tenant Schema Extension App” because it is a system application created by Microsoft Entra ID. System applications are protected objects and cannot be removed by design. Tenant deletion requires all non‑system apps to be removed, but Microsoft explicitly blocks deletion of system apps. The only supported resolution is escalation through Microsoft Support.

https://learn.microsoft.com/en-us/entra/identity/users/directory-delete-howto

“Tenant Schema Extension App” is normally associated with directory extensions created by Microsoft Entra Connect. The important part of the error is “Deletion of system application is not allowed”—this isn’t necessarily a missing administrator permission, and trying the same deletion through PowerShell or Graph may hit the same restriction.

First, check whether the customer previously used Entra Connect and whether directory synchronisation is still enabled. If they’re retiring the tenant, decommission synchronisation using Microsoft’s documented process, then rerun the tenant deletion checks. Don’t assume that uninstalling Entra Connect or deleting this application is the correct way to disable synchronisation.

Also confirm that the tenant-deletion check actually names this application as the remaining blocker. A protected application appearing in App registrations doesn’t, by itself, establish that it must be manually deleted.

If deletion checks explicitly require its removal but Entra refuses because it’s a system application, that’s a service-side cleanup issue to escalate. Avoid deleting extension definitions or changing application properties as an experiment.

Since this is a customer tenant, check the partner route: if you manage their subscription through CSP, raise the case through Partner Center or your indirect provider. A missing support contract inside the customer tenant doesn’t necessarily rule out that route. Otherwise, contact Microsoft’s business subscription/billing support and explain that the tenant cannot be closed because a protected system application blocks deletion.

Include the tenant ID, application/client ID, application object ID, the tenant-deletion check result, and the failed operation’s timestamp/correlation ID. That makes the request specific: resolve a protected system-app tenant-deletion blocker, rather than a general request for help deleting an app.