Forum Discussion
Azure Policy for Key Vault Soft Delete Retention
There is no builtin policy to do that and i would suggest to automate this in a declarative or imperative way ( Powershell or Arm or another Infra as Code tool) .
By doing that you will have config files with the right values and minimize the remediation tasks ( which are not applicable every time ) and the management overhead . Once you have done that you will simply customize a builtin policy to ensure that every deployment which have a value different from 10 will be denied .
ChrisBradshaw has shown how to that in his different comments
There is no builtin policy to do that and i would suggest to automate this in a declarative or imperative way ( Powershell or Arm or another Infra as Code tool) .
By doing that you will have config files with the right values and minimize the remediation tasks ( which are not applicable every time ) and the management overhead . Once you have done that you will simply customize a builtin policy to ensure that every deployment which have a value different from 10 will be denied .