immutability-soft-delete

name	immutability-soft-delete
description	Vault immutability and soft delete — ransomware posture

Immutability Soft Delete

When to use this skill

• Ransomware hardening
• Regulated environment

Key concepts

• Soft delete retains deleted recovery points for 14+ days; Enhanced soft delete is configurable up to 180 days and can be made always-on.
• Immutability locks the vault so retention cannot be reduced/deletions cannot be forced — set to Locked for ransomware protection.
• Multi-User Authorization (MUA) requires a separate Resource Guard owner to approve destructive actions.
• Locked immutability is irreversible — be sure before locking.
• Pair these with restricted RBAC; admins shouldn't be able to bypass.

Azure CLI examples

az dataprotection backup-vault update -g <rg> -n vault-prod \
  --immutability-state Locked

Common pitfalls

• Locking immutability before retention strategy is final — irreversible.
• Granting Owner role to ops team — bypasses MUA intent.
• Not configuring MUA Resource Guard in a separate sub/tenant — same blast radius.

References

• Microsoft Learn: search for "Immutability Soft Delete Azure VM" on https://learn.microsoft.com

---

Validation-first: verify every Azure fact against the Microsoft Learn MCP server (cite the Learn URL); Learn overrides built-in knowledge. If no Learn MCP server is configured, flag the answer ⚠️ unverified and mark specs as indicative. Analysis only — verify against Microsoft documentation before applying.