Key Vault Soft Delete and Purge Protection

Soft delete is a data protection feature for Azure Key Vault that allows recovery of deleted vaults and vault objects (secrets, keys, certificates) after they have been deleted. Without soft delete, a delete operation is irreversible—the object is immediately and permanently removed. With soft delete enabled, deleted objects are retained in a "soft-deleted" state for a configurable retention period (default 90 days, minimum 7, maximum 90). During this period, the object is not accessible for use but can be recovered (undeleted) by an authorized user. After the retention period expires, the object is automatically purged (permanently deleted). Soft delete is enabled at the vault level and can be enabled during vault creation or after creation (though enabling after creation is not recommended as objects deleted before enablement are not protected).

When a user issues a DELETE command on a secret, key, or certificate, Azure Key Vault does not immediately remove the underlying data. Instead, it marks the object as soft-deleted and moves it to a separate internal container. The object's name becomes unavailable for reuse until it is purged or the retention period expires. The object's metadata (e.g., creation date, expiration) is preserved. The soft-deleted object retains its unique identifier but is not returned in normal list operations (e.g., Get-AzKeyVaultSecret). To list soft-deleted objects, you must use the -IncludeDeleted parameter.

Purge protection is an optional feature that must be enabled when the vault is created. It cannot be enabled after creation. Once enabled, purge protection cannot be disabled. With purge protection on, no one (including the subscription owner or Microsoft support) can purge a soft-deleted vault or object until the retention period expires. This ensures that even if an attacker gains full access, they cannot permanently destroy secrets within the recovery window. Purge protection also applies to the vault itself. If a vault with purge protection is deleted, it cannot be purged until the retention period ends.

You can enable soft delete and purge protection via Azure portal, PowerShell, CLI, or ARM templates.

Azure Portal:

PowerShell:

# Enable soft delete on an existing vault
Set-AzKeyVault -VaultName 'MyVault' -EnableSoftDelete

# Enable purge protection during creation
New-AzKeyVault -VaultName 'MyVault' -ResourceGroupName 'MyRG' -Location 'EastUS' -EnableSoftDelete -EnablePurgeProtection

CLI:

# Enable soft delete on existing vault
az keyvault update --name MyVault --enable-soft-delete true

# Create vault with soft delete and purge protection
az keyvault create --name MyVault --resource-group MyRG --location eastus --enable-soft-delete true --enable-purge-protection true

Verification:

Get-AzKeyVault -VaultName 'MyVault' | Select-Object EnableSoftDelete, EnablePurgeProtection

az keyvault show --name MyVault --query '[enableSoftDelete, enablePurgeProtection]'

For vault recovery, use Get-AzKeyVault -InRemovedState and Restore-AzKeyVault -VaultName MyVault -ResourceGroupName MyRG -Location EastUS.

| Feature | Default | Range | Changeable after creation? | |---------|---------|-------|----------------------------| | Soft delete | Disabled | N/A | Yes (enable only) | | Retention period | 90 days | 7-90 days | Yes (extend only) | | Purge protection | Disabled | N/A | No (must enable at creation) | | Max soft-deleted objects | 1000 | Fixed | No |

Soft delete and purge protection are essential for compliance and data security. On the AZ-500 exam, focus on the defaults, enablement restrictions, and the difference between delete and purge permissions. Remember that purge protection is a one-time decision that cannot be reversed.

A bank uses Azure Key Vault to store encryption keys for customer transaction data. Regulatory requirements (e.g., PCI DSS) mandate that deleted keys must be recoverable for at least 90 days. The bank enables soft delete with a retention period of 90 days and purge protection on all vaults. This ensures that even if a developer accidentally deletes a key, it can be recovered without data loss. Purge protection prevents a malicious insider from permanently destroying keys to cover tracks. The bank also uses Azure Policy to enforce soft delete and purge protection across all subscriptions, with audit logs sent to a SIEM for monitoring. Performance impact is negligible; the only consideration is that soft-deleted objects count towards the vault's object limit (1000), so the bank monitors the count and purges unneeded objects after the retention period.

A SaaS company hosts customer secrets in separate Key Vaults per tenant. They enable soft delete to allow recovery from accidental deletions, but they do not enable purge protection because they want the ability to immediately purge a tenant's secrets upon account closure. However, they face a problem: if a customer accidentally deletes a secret and then closes their account, the soft-deleted secret remains for 90 days, consuming storage. To handle this, they set a shorter retention period (7 days) and automate purging of soft-deleted objects after account closure. They also use RBAC to restrict purge permissions to a security admin group only. The company learned the hard way that without purge protection, a compromised admin account could purge all secrets instantly; they now use Azure AD Privileged Identity Management (PIM) to elevate privileges only when needed.

Soft delete has negligible performance impact on normal operations. The main consideration is the soft-deleted object limit (1000 per vault). For vaults with high turnover, you may need to regularly purge or recover objects to stay under the limit. The retention period does not affect performance. Purge protection adds no performance overhead; it only restricts purge operations.

These scenarios highlight why purge protection is critical for production environments.