Key Vault Access Policy Templates Bundle Purge Rights

The Trap

The trap is the Azure Key Vault access policy preset templates — specifically “Key, Secret, & Certificate Management” — being assigned wholesale to automation service principals via az keyvault set-policy or the Portal wizard. Each preset bundles the purge permission (PurgeSoftDeleteData equivalent, exposed per object type as purge on keys, secrets and certificates) alongside get, list, create and delete, with no separate consent step and no warning that purge behaves differently from delete.

The Default State

Vault creators pick a template because it is faster than enumerating individual permissions, and the template UI presents purge as just another checkbox already ticked under the bundle. Separately, enablePurgeProtection defaults to false unless explicitly set true at creation time with az keyvault create –enable-purge-protection true or via a matching ARM/Bicep property. Soft-delete itself has been mandatory since 2020, but purge protection is not, so the two controls drift apart: soft-delete recoverability exists in theory, while purge rights held by a broad principal render it moot in practice.

The Blast Radius

A leaked pipeline credential, a compromised build agent, or a Terraform state file with embedded SPN secrets gives an attacker or a faulty deployment script direct access to az keyvault key purge, az keyvault secret purge and az keyvault certificate purge. Because the principal already holds purge under the bundled template, no privilege escalation is needed. Execution destroys the object immediately and irreversibly, bypassing the entire soft-delete retention window. Where those secrets underpin CMK-based encryption at rest, downstream services lose access to encrypted data with no recovery path, and TLS certificate purge breaks every dependent Application Gateway or Front Door listener simultaneously.

The Lead Mechanic Fix

Audit every policy with az keyvault show –name <vault> –query “properties.accessPolicies”, strip purge from any service principal that only needs operational lifecycle rights, and enforce enablePurgeProtection true through an Azure Policy definition with effect Deny on Microsoft.KeyVault/vaults missing that property. Migrate high-value vaults to RBAC and assign Key Vault Crypto User rather than Key Vault Administrator, reserving purge-capable roles for break-glass identities under PIM with time-bound activation.