Share via

Azure Backup Immutability - Lock from Deletion

zgmp 20 Reputation points
2025-10-09T06:05:42.83+00:00

I am Enabling Azure Backup for our workloads like Virtual Machines. I know there is a feature of immutability that disables the ability to delete older snapshots till the retention period expires. However, what happens if a malicious attacker gains access to my account and deletes the entire Recovery Vault itself? Is there a way to protect the deletion of the entire Vault? I could not see this feature in the Documentation.

Azure Backup
Azure Backup
An Azure backup service that provides built-in management at scale.
Answer accepted by question author
  1. Andreas Baumgarten 128.8K Reputation points MVP Volunteer Moderator
    2025-10-09T08:09:17.47+00:00

    Hi @zgmp ,

    in short: You can't delete an Azure Recovery Services Vault (RSV) if:

    • You can't delete a vault that contains protected data sources (for example, IaaS VMs, SQL databases, Azure file shares).
    • You can't delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted state.
    • You can't delete a vault that contains backup data in the soft deleted state.
    • You can't delete a vault that has registered storage accounts.

    Source: Delete an Azure Backup Recovery Services vault

    This being said:

    To delete an Azure Recovery Services Vault in your scenario you have to remove the backups and protected objects first. This should not be possible if you use the immutability option.

    Source: Restricted operations

    To add more protection you can set immutability irreversible on your RSV: Making immutability irreversible

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards

    Andreas Baumgarten

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.