Azure Key Vault: recover deleted secrets with soft-delete and purge protection

Accidental deletion should not be permanent

A deleted secret, key or certificate in Azure Key Vault can be recovered if soft-delete is active and purge protection is considered. The useful takeaway is to verify the vault is configured for recoverability before relying on it, and to rehearse recovery with a test object so naming and permissions are understood.

What soft-delete and purge protection actually do

Soft-delete moves a deleted object to a recoverable state for a retention period instead of removing it immediately. New vaults have soft-delete enabled by default and it cannot be disabled. Retention is configurable per vault between 7 and 90 days, default 90 days.

Purge protection is optional. When enabled it blocks permanent purge of soft-deleted objects until retention expires. Once enabled on a vault it cannot be turned off. This protects against accidental or malicious purge by anyone, including subscription owners.

Deleting a secret removes all its versions together. Recovery restores the whole secret with its version history. You cannot undelete a single version. Soft-delete protects against deletion, not against overwriting a secret with a bad value. Versioning and rollback to a previous version is the recovery path for bad updates.

Prerequisites

• A Key Vault in the target subscription. The vault must be in Azure Resource Manager mode.
• Permission to read vault properties and change configuration. Owner or Key Vault Administrator is typical for enabling purge protection.
• Permission to recover objects. In RBAC mode this requires the recover permission, for example Key Vault Administrator or Key Vault Officer. In access policy mode the recover permission must be granted on the vault.
• Know which authorization model the vault uses: RBAC or legacy access policies. Role and permission names differ between models.

Check current vault settings

Run from Azure Cloud Shell or a local machine with the Azure CLI installed and logged in.

az keyvault show --name <vault-name> --resource-group <resource-group> --query "{softDelete:properties.enableSoftDelete, retentionDays:properties.softDeleteRetentionInDays, purgeProtection:properties.enablePurgeProtection}"

Expected checks: softDelete is true, retentionDays is within 7-90, purgeProtection reflects the desired policy. The vault name is reserved while a soft-deleted vault exists, so recreating a vault with the same name fails until recovery or purge.

Enable purge protection

Purge protection is irreversible per vault. Test in a non-production vault first.

az keyvault update --name <vault-name> --resource-group <resource-group> --enable-purge-protection true

Required permissions: Microsoft.KeyVault/vaults/write on the vault. Risk: the setting cannot be disabled later. Soft-deleted objects still count toward vault object quotas and can affect automation that lists or recreates resources.

Delete and recover a test object

Create a test secret with a unique name to avoid collisions.

az keyvault secret set --vault-name <vault-name> --name test-recovery-secret --value "placeholder"

Delete the secret. Deletion triggers soft-delete.

az keyvault secret delete --vault-name <vault-name> --name test-recovery-secret

Confirm the object appears as deleted. The portal shows a deleted items list with a scheduled purge date. Via CLI:

az keyvault secret list-deleted --vault-name <vault-name>

Recover the object.

az keyvault secret recover --vault-name <vault-name> --name test-recovery-secret

Required permission: recover on the vault. After recovery, all versions of the secret return.

Expected checks after recovery

• The secret is listed again with az keyvault secret list and az keyvault secret show.
• Version history is intact. You can list versions with az keyvault secret list-versions.
• If purge protection is enabled, an attempt to purge the soft-deleted object is denied before retention expires. This confirms the guardrail is active.
• Vault properties still show soft-delete enabled and purge protection enabled.

Limits and recovery options

Soft-delete retention is per vault and applies to secrets, keys and certificates. Recovery is only possible within the retention window. After retention expires the object is purged automatically.

A deleted vault name remains reserved during retention. Recovery of the vault restores the name. Purge is the only way to release the name early, which purge protection blocks.

Role names differ between RBAC and access policy mode. Confirm the model before granting recover rights, otherwise recovery operations fail with authorization errors.

Practical verification checklist

• Confirm soft-delete retention and purge protection state in vault properties.
• Delete a test secret, verify it appears in deleted items with a purge date.
• Recover the test secret and verify all versions return.
• Document who holds recover permission and how vault access is audited.