Key Vault Managed HSMs should have purge protection enabled
Malicious deletion of an Azure Key Vault Managed HSM can lead to permanent data loss. Purge protection enforces a mandatory retention period for soft deleted Azure Key Vault Managed HSM. No one can purge it during the soft delete retention period.
Malicious deletion of an Azure Key Vault Managed HSM can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge Azure Key Vault Managed HSM. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted Azure Key Vault Managed HSM.
What this control checks
Azure Key Vault Managed HSM should have purge protection enabled
Common pitfalls
Soft delete must also be enabled
The policy flags a Managed HSM when Microsoft.KeyVault/managedHsms/enableSoftDelete notEquals true. It also flags it when Microsoft.KeyVault/managedHsms/enablePurgeProtection notEquals true.
Default effect is Audit
The effect parameter allows Audit, Deny and Disabled. Its defaultValue is Audit.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Key Vault Managed HSM should have purge protection enabled" (c39ba22d-4428-4149-b981-70acb31fc383); PowerPipe control azure_compliance.control.keyvault_managed_hms_purge_protection_enabled.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 1635.12b1Organizational.2-12.b (12.01 Information Security Aspects of Business Continuity Management).
Framework mappings
The clauses this control is mapped to in each framework.
- 1635.12b1Organizational.2-12.b 12.01 Information Security Aspects of Business Continuity Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_managed_hms_purge_protection_enabled - Powerpipe Control:
azure_compliance.control.keyvault_managed_hms_purge_protection_enabled - Azure Policy Definition:
c39ba22d-4428-4149-b981-70acb31fc383
Last reviewed: 2026-10-13