Azure Compliance ControlsAzure Key Vault
Key Vault Managed HSMs should have purge protection enabled
Malicious deletion of an Azure Key Vault Managed HSM can lead to permanent data loss. Purge protection enforces a mandatory retention period for soft deleted Azure Key Vault Managed HSM. No one can purge it during the soft delete retention period.
What this control checks
Azure Key Vault Managed HSM should have purge protection enabled
Framework mappings
The clauses this control is mapped to in each framework.
- 1635.12b1Organizational.2-12.b 12.01 Information Security Aspects of Business Continuity Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_managed_hms_purge_protection_enabled - Powerpipe Control:
azure_compliance.control.keyvault_managed_hms_purge_protection_enabled - Azure Policy Definition:
c39ba22d-4428-4149-b981-70acb31fc383
Last reviewed: 2026-10-13