Key vaults should have purge protection enabled

What does the recommendation "Key vaults should have purge protection enabled" check?

Flags any key vault where the 'enablePurgeProtection' property is not set to true. Purge protection builds on soft-delete: it stops anyone, including subscription owners and Microsoft, from permanently purging a deleted vault or a deleted key, secret or certificate before its soft-delete retention period (7 to 90 days, default 90) has elapsed. The control checks only that the option is switched on at the vault level. It does not check whether soft-delete itself is enabled, what retention window you chose, whether deletion alerts are configured, or whether your access policies and RBAC role assignments are scoped correctly. It also says nothing about the secrets inside the vault, only about your ability to recover them if they are deleted.

Why does "Key vaults should have purge protection enabled" matter?

Without purge protection, a deleted key vault object can be purged immediately, and a purge is irreversible. A compromised credential, a buggy automation script or a malicious insider can delete and then purge an encryption key in seconds, and any storage account, managed disk or database encrypted with that customer-managed key becomes permanently unreadable. The data is not lost in transit, it is mathematically unrecoverable, which can mean an unrecoverable outage, breached recovery obligations and regulatory exposure. Soft-delete alone is not enough, because the same actor who deletes an object can usually purge it straight afterwards. Purge protection enforces the retention window as a hard floor that nobody can override, buying you time to detect the action and recover, which is why services like Storage and Azure Disk Encryption require it before they will use a vault for customer-managed keys.

How do I fix "Key vaults should have purge protection enabled"?

1. Confirm soft-delete is enabled first, since purge protection cannot be turned on without it: check the vault's 'enableSoftDelete' property and set a retention period that meets your recovery and compliance needs (7 to 90 days).
2. Enable purge protection on the vault with 'az keyvault update --name <vault> --resource-group <rg> --enable-purge-protection true', or set 'enablePurgeProtection: true' in your Bicep or ARM template. Note this is one-way: once enabled it cannot be disabled.
3. Default the setting to true in your infrastructure-as-code modules and enforce it with the built-in Azure Policy 'Key vaults should have purge protection enabled' so new vaults are compliant from creation rather than remediated later.

# Enable purge protection on every vault that lacks it. Note: this CANNOT be undone.
for kv in $(az keyvault list \
    --query "[?properties.enablePurgeProtection==null].name" -o tsv); do
  az keyvault update --name "$kv" --enable-purge-protection true
  echo "$kv: purge protection enabled (irreversible)"
done

# Give a key an expiration date and a rotation policy so it rotates before it lapses.
az keyvault key set-attributes --vault-name kv-payments-prod \
  --name db-encryption-key --expires "$(date -u -d '+1 year' +%Y-%m-%dT%H:%M:%SZ)"
az keyvault key rotation-policy update --vault-name kv-payments-prod \
  --name db-encryption-key --value @rotation-policy.json

# Ratchet it shut: deny any future vault created without deletion protection.
az policy assignment create \
  --name deny-kv-no-purge \
  --policy 0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"