diff --git a/upup/pkg/fi/cloudup/azure/applicationsecuritygroup.go b/upup/pkg/fi/cloudup/azure/applicationsecuritygroup.go
index d79b3c2e46..f330f288b2 100644
--- a/upup/pkg/fi/cloudup/azure/applicationsecuritygroup.go
+++ b/upup/pkg/fi/cloudup/azure/applicationsecuritygroup.go
@@ -18,8 +18,10 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	network "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
 )
@@ -50,11 +52,19 @@ func (c *ApplicationSecurityGroupsClientImpl) CreateOrUpdate(ctx context.Context
 }
 
 func (c *ApplicationSecurityGroupsClientImpl) List(ctx context.Context, resourceGroupName string) ([]*network.ApplicationSecurityGroup, error) {
+	if resourceGroupName == "" {
+		return nil, nil
+	}
+
 	var l []*network.ApplicationSecurityGroup
 	pager := c.c.NewListPager(resourceGroupName, nil)
 	for pager.More() {
 		resp, err := pager.NextPage(ctx)
 		if err != nil {
+			var respErr *azcore.ResponseError
+			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
+				return nil, nil
+			}
 			return nil, fmt.Errorf("listing application security groups: %w", err)
 		}
 		l = append(l, resp.Value...)
diff --git a/upup/pkg/fi/cloudup/azure/loadbalancer.go b/upup/pkg/fi/cloudup/azure/loadbalancer.go
index 1aee862063..8932c0719c 100644
--- a/upup/pkg/fi/cloudup/azure/loadbalancer.go
+++ b/upup/pkg/fi/cloudup/azure/loadbalancer.go
@@ -18,8 +18,10 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	network "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
@@ -52,11 +54,19 @@ func (c *loadBalancersClientImpl) CreateOrUpdate(ctx context.Context, resourceGr
 }
 
 func (c *loadBalancersClientImpl) List(ctx context.Context, resourceGroupName string) ([]*network.LoadBalancer, error) {
+	if resourceGroupName == "" {
+		return nil, nil
+	}
+
 	var l []*network.LoadBalancer
 	pager := c.c.NewListPager(resourceGroupName, nil)
 	for pager.More() {
 		resp, err := pager.NextPage(ctx)
 		if err != nil {
+			var respErr *azcore.ResponseError
+			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
+				return nil, nil
+			}
 			return nil, fmt.Errorf("listing load balancers: %w", err)
 		}
 		l = append(l, resp.Value...)
diff --git a/upup/pkg/fi/cloudup/azure/natgateway.go b/upup/pkg/fi/cloudup/azure/natgateway.go
index 1f984bad82..cd35bbd74e 100644
--- a/upup/pkg/fi/cloudup/azure/natgateway.go
+++ b/upup/pkg/fi/cloudup/azure/natgateway.go
@@ -18,8 +18,10 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	network "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
 )
@@ -50,11 +52,19 @@ func (c *NatGatewaysClientImpl) CreateOrUpdate(ctx context.Context, resourceGrou
 }
 
 func (c *NatGatewaysClientImpl) List(ctx context.Context, resourceGroupName string) ([]*network.NatGateway, error) {
+	if resourceGroupName == "" {
+		return nil, nil
+	}
+
 	var l []*network.NatGateway
 	pager := c.c.NewListPager(resourceGroupName, nil)
 	for pager.More() {
 		resp, err := pager.NextPage(ctx)
 		if err != nil {
+			var respErr *azcore.ResponseError
+			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
+				return nil, nil
+			}
 			return nil, fmt.Errorf("listing nat gateways: %w", err)
 		}
 		l = append(l, resp.Value...)
diff --git a/upup/pkg/fi/cloudup/azure/networksecuritygroup.go b/upup/pkg/fi/cloudup/azure/networksecuritygroup.go
index bf85865b7b..0239cafe18 100644
--- a/upup/pkg/fi/cloudup/azure/networksecuritygroup.go
+++ b/upup/pkg/fi/cloudup/azure/networksecuritygroup.go
@@ -18,8 +18,10 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	network "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
 )
@@ -50,11 +52,19 @@ func (c *NetworkSecurityGroupsClientImpl) CreateOrUpdate(ctx context.Context, re
 }
 
 func (c *NetworkSecurityGroupsClientImpl) List(ctx context.Context, resourceGroupName string) ([]*network.SecurityGroup, error) {
+	if resourceGroupName == "" {
+		return nil, nil
+	}
+
 	var l []*network.SecurityGroup
 	pager := c.c.NewListPager(resourceGroupName, nil)
 	for pager.More() {
 		resp, err := pager.NextPage(ctx)
 		if err != nil {
+			var respErr *azcore.ResponseError
+			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
+				return nil, nil
+			}
 			return nil, fmt.Errorf("listing network security groups: %w", err)
 		}
 		l = append(l, resp.Value...)
diff --git a/upup/pkg/fi/cloudup/azure/publicipaddress.go b/upup/pkg/fi/cloudup/azure/publicipaddress.go
index 4d71cda5ca..b1e52e46b0 100644
--- a/upup/pkg/fi/cloudup/azure/publicipaddress.go
+++ b/upup/pkg/fi/cloudup/azure/publicipaddress.go
@@ -18,8 +18,10 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	network "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
 )
@@ -50,11 +52,19 @@ func (c *publicIPAddressesClientImpl) CreateOrUpdate(ctx context.Context, resour
 }
 
 func (c *publicIPAddressesClientImpl) List(ctx context.Context, resourceGroupName string) ([]*network.PublicIPAddress, error) {
+	if resourceGroupName == "" {
+		return nil, nil
+	}
+
 	var l []*network.PublicIPAddress
 	pager := c.c.NewListPager(resourceGroupName, nil)
 	for pager.More() {
 		resp, err := pager.NextPage(ctx)
 		if err != nil {
+			var respErr *azcore.ResponseError
+			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
+				return nil, nil
+			}
 			return nil, fmt.Errorf("listing public ip addresses: %w", err)
 		}
 		l = append(l, resp.Value...)
diff --git a/upup/pkg/fi/cloudup/azure/routetable.go b/upup/pkg/fi/cloudup/azure/routetable.go
index f0a0c355fb..dfdddd4b15 100644
--- a/upup/pkg/fi/cloudup/azure/routetable.go
+++ b/upup/pkg/fi/cloudup/azure/routetable.go
@@ -18,8 +18,10 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	network "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
 )
@@ -50,11 +52,19 @@ func (c *routeTablesClientImpl) CreateOrUpdate(ctx context.Context, resourceGrou
 }
 
 func (c *routeTablesClientImpl) List(ctx context.Context, resourceGroupName string) ([]*network.RouteTable, error) {
+	if resourceGroupName == "" {
+		return nil, nil
+	}
+
 	var l []*network.RouteTable
 	pager := c.c.NewListPager(resourceGroupName, nil)
 	for pager.More() {
 		resp, err := pager.NextPage(ctx)
 		if err != nil {
+			var respErr *azcore.ResponseError
+			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
+				return nil, nil
+			}
 			return nil, fmt.Errorf("listing route tables: %w", err)
 		}
 		l = append(l, resp.Value...)
diff --git a/upup/pkg/fi/cloudup/azure/virtualnetwork.go b/upup/pkg/fi/cloudup/azure/virtualnetwork.go
index d8812856e0..317160b868 100644
--- a/upup/pkg/fi/cloudup/azure/virtualnetwork.go
+++ b/upup/pkg/fi/cloudup/azure/virtualnetwork.go
@@ -18,8 +18,10 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	network "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
 )
@@ -50,11 +52,19 @@ func (c *virtualNetworksClientImpl) CreateOrUpdate(ctx context.Context, resource
 }
 
 func (c *virtualNetworksClientImpl) List(ctx context.Context, resourceGroupName string) ([]*network.VirtualNetwork, error) {
+	if resourceGroupName == "" {
+		return nil, nil
+	}
+
 	var l []*network.VirtualNetwork
 	pager := c.c.NewListPager(resourceGroupName, nil)
 	for pager.More() {
 		resp, err := pager.NextPage(ctx)
 		if err != nil {
+			var respErr *azcore.ResponseError
+			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
+				return nil, nil
+			}
 			return nil, fmt.Errorf("listing virtual networks: %w", err)
 		}
 		l = append(l, resp.Value...)
diff --git a/upup/pkg/fi/cloudup/azure/vmscaleset.go b/upup/pkg/fi/cloudup/azure/vmscaleset.go
index bce8a27596..444d7f84c0 100644
--- a/upup/pkg/fi/cloudup/azure/vmscaleset.go
+++ b/upup/pkg/fi/cloudup/azure/vmscaleset.go
@@ -18,8 +18,10 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	compute "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute"
@@ -52,11 +54,19 @@ func (c *vmScaleSetsClientImpl) CreateOrUpdate(ctx context.Context, resourceGrou
 }
 
 func (c *vmScaleSetsClientImpl) List(ctx context.Context, resourceGroupName string) ([]*compute.VirtualMachineScaleSet, error) {
+	if resourceGroupName == "" {
+		return nil, nil
+	}
+
 	var l []*compute.VirtualMachineScaleSet
 	pager := c.c.NewListPager(resourceGroupName, nil)
 	for pager.More() {
 		resp, err := pager.NextPage(ctx)
 		if err != nil {
+			var respErr *azcore.ResponseError
+			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
+				return nil, nil
+			}
 			return nil, fmt.Errorf("listing VMSSs: %w", err)
 		}
 		l = append(l, resp.Value...)