How to improve security level for Recovery Service Vault its showing poor

Hello, @Thakur, Shubhankar11

Here is a recommendation https://learn.microsoft.com/en-us/answers/questions/1808654/how-to-improve-security-level-for-backup-vault

Here is a resume of what you would see in the URL above:

1. Enable Soft Delete (Required)

Prevents accidental or malicious deletion of backup items like VMs, SQL databases, etc.

Navigate to your Recovery Services Vault > Properties > Ensure Soft Delete is Enabled.

• Mandatory for Azure VM backups.

2. Enable Multi-User Authorization (MUA) for Critical Operations

Adds a layer of protection for sensitive actions (e.g., delete backup data, modify protection).

Go to Vault > Properties > Security Settings > Enable Multi-User Authorization (MUA).

Requires a separate Security PIN to authorize critical operations.

This protects against malicious insiders or compromised accounts.

3. Enable Immutable Vault (Preview or GA)

Makes the vault read-only for a configured retention period (ideal for ransomware protection).

Go to Properties > Enable Immutable Vault.

Configure retention lock to prevent tampering.

4. Use Customer-Managed Keys (CMK) for Encryption

Instead of platform-managed keys, use Azure Key Vault to control encryption keys.

Create a Key Vault and assign access.

Go to Vault > Properties > Encryption > Select Customer Managed Key.

5. Audit and Enable Logging

Enable Azure Monitor diagnostics to track backup and restore operations.

Go to Vault > Diagnostic Settings:

Send logs to Log Analytics, Storage, or Event Hub.

  Monitor operations, failures, and suspicious access.
  

6. Use Private Endpoints (Optional but Recommended)

Restrict access to the Recovery Services Vault to only your private network.

Go to Vault > Networking > Enable Private Endpoint.

Blocks public access unless explicitly allowed.

7. RBAC and Least Privilege Access

Review who has access to the vault. Use Role-Based Access Control (RBAC):

Only grant access to necessary users.

Use built-in roles like Backup Contributor or custom roles with limited scope.

8. Enable Alerts for Suspicious Activity

Go to Vault > Monitoring > Backup Alerts:

• Enable built-in alerts for:
  • Failed backups
  • Unusual deletion requests
  • Restore activityTo improve the security level of your Azure Recovery Services Vault

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!