What this query does
This Azure Resource Graph health query inspects Key Vault protection settings and returns vaults that do not meet the expected deletion-recovery baseline. It provides a compact secrets-governance view across subscriptions without requiring teams to inspect each vault individually.
What This Query Detects
- Key Vault instances where soft delete is disabled or not reported as enabled.
- Key Vault instances where purge protection is disabled.
- Vaults that diverge from the expected secrets-protection baseline.
Why It Matters
Key Vault stores credentials, keys, and certificates that other systems depend on. Without soft delete and purge protection, recovery from accidental or malicious deletion is weaker. Purge protection is especially important because it reduces the chance that a deleted vault or object can be permanently removed before the retention period expires.
Example Output Fields
Field availability reflects the health query contract and the resource properties available to Azure Resource Graph.
| Field | How to use it |
|---|---|
subscriptionId | Azure subscription that owns the vault. |
resourceGroup | Resource group containing the vault. |
vaultName | Key Vault resource name. |
location | Azure region in which the vault is deployed. |
softDeleteEnabled | Whether soft delete protection is enabled. |
purgeProtectionEnabled | Whether purge protection is enabled. |
tenantId | Microsoft Entra tenant associated with the vault. |
skuName | Key Vault SKU reported by the resource. |
riskReason | Normalized explanation of the protection gap detected. |
How To Read The Results
Prioritize vaults with purge protection disabled when they hold production secrets, encryption keys, or certificates. That setting is a key defense against accidental or malicious permanent deletion. Soft delete findings should also be investigated, including whether the resource API reports a legacy or incomplete configuration state.
riskReason reference
Soft delete disabled- Deleted vault content has weaker built-in recovery protection.
Purge protection disabled- A deleted vault or object may be permanently purged before the retention period ends, subject to Azure behavior and permissions.
What You Gain On A Dashboard
Dashboard outcomes
- A direct view of critical Key Vault protection gaps.
- A measurable secrets-governance baseline signal.
- Faster discovery of vaults that need protection-setting remediation.
Best for dashboards focused on
- Secrets governance
- Key Vault hardening
- Deletion recovery
- Security controls
Keep critical secrets protection gaps in view
Connect your Azure environment to VYRE Cloud and bring deletion protection, vault hardening, and remediation priorities into one operational view.
Your environment. Your priorities. One dashboard built around the signals that matter.
- Vault protection status
- Secrets governance gaps
- Remediation priorities
Recommended Use Cases
- Continuous Key Vault baseline monitoring.
- Security architecture and secrets-governance reviews.
- Pre-audit checks for deletion protection controls.
- Prioritizing remediation for production and shared-platform vaults.