Status: IN
Key Vault provides three-layer deletion protection: soft-delete enables recovery within 7–90 days, purge protection prevents permanent deletion during retention, and purge itself requires elevated privileges (Purge Operator role or subscription Owner).