An operator accidentally deletes the Key Vault secret canal-sql-cs. The vault still exists. What should the security engineer do first?
Select an answer to reveal the explanation.
Short Explanation
Don’t mint a brand-new connection string and run a pager storm. Soft-delete kept canal-sql-cs recoverable—pull it back from the deleted objects list while the vault is still there.
Full Explanation
Soft-delete retains deleted Key Vault secrets, keys, certificates, and vaults for a configurable retention period (commonly 7–90 days) and is on by default for modern vaults. Recovering the soft-deleted object restores the original name and versions callers already expect. Creating a new secret forces coordinated rediscovery. Immediate purge defeats recovery. Azure VM backup does not replace Key Vault soft-delete recover for vault objects.