An insider deletes the lock-lab Key Vault and attempts to purge it the same day. Which control prevents that immediate purge even for a subscription Owner?
Select an answer to reveal the explanation.
Short Explanation
Soft-delete gives you a recycle bin; purge protection welds it shut for the retention window. Even Owner can’t flush the vault the same day once purge protection is on—and you can’t switch that guard off later.
Full Explanation
Purge protection builds on soft-delete so soft-deleted vaults and objects cannot be purged until the retention interval ends, including attempts by highly privileged subscription roles. Soft-delete without purge protection still allows authorized purge during retention. The setting cannot be disabled after enablement, which is intentional for irreversible insider-threat hardening. Storage blob versioning and blanket Conditional Access blocks are not the Key Vault purge-protection control.