Backup operators on the canal estate were given Owner on the Recovery Services vault and can delete the vault itself. Which change restores least privilege for daily backup work?
Select an answer to reveal the explanation.
Short Explanation
Owner is a skeleton key—it opens the vault door and the demolition panel. Hand the crew Backup Contributor, Operator, or Reader for the shift work and keep delete-vault rights off the daily badge.
Full Explanation
Azure Backup defines job-function roles such as Backup Contributor, Backup Operator, and Backup Reader for operational backup tasks without granting full resource control. Owner can delete the Recovery Services vault and far exceeds daily backup needs. Policy audits and sandbox moves do not replace correct RBAC on the production vault.