Skip to content

Use Key Vault Purge Protection#

Reliability · Key Vault · Azure.KeyVault.PurgeProtect

Enable Purge Protection on Key Vaults to prevent early purge of vaults and vault items.

Description#

Purge Protection is a feature of Key Vault that prevents purging of vaults and vault items. When soft delete is configured without purge protection, deleted vaults and vault items can be purged. Purging deletes the vault and/ or vault items immediately, and is irreversible.

When purge protection is enabled, vaults and vault items can no longer be purged. Deleted vaults and vault items will be recoverable until the configured retention period. By default, the retention period is 90 days.

Purge protection is not enabled by default.

Recommendation#

Consider enabling purge protection on Key Vaults to enforce retention of vaults and vault items for up to 90 days.

Examples#

Azure templates#

To deploy key vaults that pass this rule:

  • Set the properties.enablePurgeProtection property to true.

For example:

{
    "comments": "Create or update a Key Vault.",
    "type": "Microsoft.KeyVault/vaults",
    "name": "vault-001",
    "apiVersion": "2019-09-01",
    "location": "eastus",
    "properties": {
        "accessPolicies": [],
        "tenantId": "[subscription().tenantId]",
        "sku": {
            "name": "Standard",
            "family": "A"
        },
        "enableSoftDelete": true,
        "enablePurgeProtection": true
    }
}

Last update: 2021-09-24