MT.1065 - Ensure all Recovery Services Vaults have soft delete enabled

Contributed by Beerd Veldman with Lukas GoslingAll contributors →

Overview

Soft delete ensures that backup items and recovery points are retained for a period after deletion. This protects against accidental or malicious deletion of backups.

Ensure that all Recovery Services Vaults across all subscriptions have soft delete enabled.

Remediation action

To enable soft delete on a Recovery Services Vault:

1. Go to the Azure portal.
2. Navigate to Recovery Services Vaults
3. Select the vault and go to Properties
4. Under Soft Delete, ensure it is set to Enabled

Note: New vaults typically have soft delete enabled by default.

Related links

• Soft delete for Recovery Services vaults

Test Metadata

Field	Value
Test ID	MT.1065
Severity	High
Suite	Maester
Product	Azure
Feature	Backup
Area	Data protection
Resource type	AzureResource
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1490 Inhibit System Recovery, T1485 Data Destruction
Supports controls	nist-800-53-r5:CP-9
PowerShell test	Test-MtVaultSoftDelete
Services	Azure

Source

• Test: tests/maester/azure/Test.MT.1065.ps1
• Documentation: tests/maester/azure/Test.MT.1065.md