Key vaults should have recoverability configured
Malicious deletion of a key vault can lead to permanent data loss. Purge protection and soft delete prevent permanent data loss. Purge protection enforces a mandatory retention period for soft deleted key vaults.
Malicious deletion of a key vault can lead to permanent data loss. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft will be able to purge your key vaults during the soft delete retention period.
What this control checks
Key vaults must have purge protection and soft delete enabled
Common pitfalls
Key vaults after September 1st 2019 have soft-delete
Keep in mind that key vaults created after September 1st 2019 have soft-delete enabled by default.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Key vaults should have deletion protection enabled" (0b60c0b2-2dc2-4e1c-b5c9-abbed971de53); PowerPipe controls azure_compliance.control.keyvault_purge_protection_enabled and azure_compliance.control.keyvault_vault_recoverable.
Scans of the Terraform code that flag the same setting before deployment: Checkov checks CKV_AZURE_110 and CKV_AZURE_42; KICS query "Beta - Key Vault Purge Protection Is Enabled" (cec6e005-9309-46eb-b34b-456f6eae818b).
Framework-specific interpretation
FedRAMP Moderate Baseline Rev 4: Mapped to CP-9 (Information System Backup).
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- CP-9: Information System Backup
- 9.3.5 Ensure the Key Vault is Recoverable
- 8.4 Ensure the key vault is recoverable
- 8.5 Enable role-based access control (RBAC) within Azure Kubernetes Services
- 8.6 Ensure the key vault is recoverable
- 8.7 Enable role-based access control (RBAC) within Azure Kubernetes Services
- 8.5 Ensure the key vault is recoverable
- 8.5 Ensure the Key Vault is Recoverable
- 8.5 Ensure the Key Vault is Recoverable
- 3.3.5 Ensure the Key Vault is Recoverable
- MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_vault_recoverable - Checkov Checks:
CKV_AZURE_110,CKV_AZURE_42 - Powerpipe Controls:
azure_compliance.control.keyvault_purge_protection_enabled,azure_compliance.control.keyvault_vault_recoverable - Azure Policy Definition:
0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 - KICS Query:
cec6e005-9309-46eb-b34b-456f6eae818b
Last reviewed: 2026-10-13