Only the MCMU primary administrator can delete VMs and VM groups. When a VM component is deleted, the corresponding keys are automatically deleted, and email is sent to the primary administrator.
To verify this feature, before you delete a VM component, log into the MCMU BUI as a primary administrator, and view the encryption keys (System Settings → Security). Delete the VM component, the view the keys again. The VM and associated key label for the deleted component is no longer displayed.