Recovery Services vault should enable soft delete

High Azure General recovery-vault-soft-delete

Applies to

Microsoft.RecoveryServices/vaults

What CGPulse checks

A resource passes this rule when softDeleteEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable soft delete to allow recovery of accidentally deleted backup items. In Azure Portal: Recovery Services vault > Properties > enable Soft delete. See: https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature-cloud

CLI

az backup vault backup-properties set --resource-group "{rg}" --name "{name}" --soft-delete-feature-state Enable

Terraform

resource "azurerm_recovery_services_vault" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  sku                 = "Standard"
  soft_delete_state = "AlwaysOn"
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan