cis-azure-foundations-8-3-5

name	cis-azure-foundations-8.3.5
description	Ensure the Key Vault is Recoverable
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","security","key-vault","soft-delete","purge-protection"]
cis_id	8.3.5
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

8.3.5 Ensure the Key Vault is Recoverable (Automated)

Description

Ensure that Azure Key Vaults are configured with both soft delete and purge protection enabled, making the Key Vault and its objects recoverable in the event of accidental or malicious deletion.

Rationale

Azure Key Vault stores critical cryptographic keys, secrets, and certificates. Accidental or malicious deletion of a Key Vault or its contents can have catastrophic consequences, including data loss and service outages. Soft delete enables recovery of deleted vaults and vault objects for a configurable retention period (default 90 days). Purge protection prevents permanent deletion during the retention period, even by administrators. Together, these features provide a safety net against both accidental and malicious destruction of key material.

Impact

Enabling soft delete and purge protection means that deleted Key Vaults and their objects cannot be permanently removed until the retention period expires. This may impact organizations that need to rapidly reclaim Key Vault names or immediately remove sensitive data. The retention period is configurable between 7 and 90 days. Note that soft delete is now enforced by Azure for all new Key Vaults and cannot be disabled.

Audit Procedure

From Azure Portal:

1. Go to Key vaults.
2. Click the name of a Key Vault.
3. Under Settings, click Properties.
4. Verify that Soft delete is shown as enabled.
5. Verify that Purge protection is shown as enabled.

From Azure CLI:

az keyvault list --query "[].{Name:name, SoftDelete:properties.enableSoftDelete, PurgeProtection:properties.enablePurgeProtection}" -o table

Ensure both SoftDelete and PurgeProtection are true for all Key Vaults.

For a specific vault:

az keyvault show --name {vaultName} --query "{SoftDelete:properties.enableSoftDelete, PurgeProtection:properties.enablePurgeProtection}"

From PowerShell:

Get-AzKeyVault | ForEach-Object {
    Get-AzKeyVault -VaultName $_.VaultName | Select-Object VaultName, EnableSoftDelete, EnablePurgeProtection
}

Ensure both EnableSoftDelete and EnablePurgeProtection are True.

Expected Result

All Key Vaults should have both soft delete and purge protection enabled.