Introduction
Azure Key Vault is a cloud service provided by Microsoft to store securely and access secrets, including API keys, passwords, certificates, and cryptographic keys. It plays a critical role in maintaining application security and managing sensitive information in Azure.
In the real world, there might be a case where you mistakenly delete a Key Vault that stores vital secrets or certificates. Fortunately, Azure provides a safety net through a built-in soft-delete feature, allowing you to recover deleted vaults — but only within a certain period.
In this article, we’ll explore how to recover a deleted Azure Key Vault using the Azure CLI and Azure Portal, and what you need to know to ensure successful recovery.
You’re managing a production environment, and while cleaning up unused resources, you accidentally delete the Key Vault linked to your App Service. Suddenly, your app can’t read secrets, leading to failures across the board. You panic, thinking everything is lost — but it’s not. With soft delete, your Key Vault is not permanently gone; you can recover it easily, within the retention window.
What Is Soft-Delete and Retention?
Soft delete is a built-in feature of Azure Key Vault that prevents accidental data loss. When you delete a Key Vault, it’s not immediately purged. Instead, it is placed in a “deleted” state for a retention period.
The Default retention period is 90 days. During this time, you can recover or permanently purge the Key Vault.
How to Recover a Deleted Azure Key Vault?
Using Azure CLI
If you prefer command-line tools, Azure CLI makes recovery quick and scriptable.
Use the Azure CLI command below to recover the key vault
az keyvault recover --name <your-vault-name>Using Azure Portal
- Go to the Azure Portal.
- Search for Key Vaults in the top search bar.
- Click “Manage deleted vaults” from the toolbar.
- Locate your deleted vault
- Click on the vault and then click Recover.
That’s it! Azure will restore the Key Vault and its contents automatically.
- You cannot create a new vault with the same name while it’s in the deleted state.
- Only users with sufficient RBAC or Access Policy permissions can recover deleted vaults.
- After the retention period ends, the vault is permanently deleted and cannot be recovered.
Summary
Azure Key Vault provides a secure mechanism to store secrets, keys, and certificates, and it comes with built-in protection from accidental deletions through soft-delete. If you ever find yourself in a situation where a vault was removed accidentally, don’t panic. By understanding how to recover a deleted Key Vault, you can ensure your critical secrets and services stay safe.
