Microsoft.KeyVault/vaults/secrets/delete
Azure
Microsoft.KeyVault/vaults/secrets/delete
Event
Deletes a secret from an Azure Key Vault.
Security Context
- Destructive deletion of a secret breaks any application or service that retrieves it at runtime, causing operational disruption until it is restored or recreated.
- With soft-delete enabled the secret can be recovered during the retention window; without it, deletion is permanent.
Log Source
Azure Key Vault diagnostic logs — deleting a secret is a data-plane operation captured in the vault’s AuditEvent diagnostic category (which requires a diagnostic setting on the vault to be collected); it is not recorded in the subscription-level Activity Log, which only sees control-plane operations such as deleting the vault itself.
Sample Event
Adversarial. draco@fantasticlogs.cloud deletes the secret bowtruckle/prod/db-password in kv-bowtruckle-prod — destructive impact on the dependent application that pulls the DB password at startup, which fails on its next credential fetch.
{ "time": "2026-04-15T18:13:42.6029771Z", "resourceId": "/SUBSCRIPTIONS/20000000-0000-4000-8000-000000000001/RESOURCEGROUPS/RG-BOWTRUCKLE-VAULT/PROVIDERS/MICROSOFT.KEYVAULT/VAULTS/KV-BOWTRUCKLE-PROD", "operationName": "SecretDelete", "operationVersion": "7.4", "category": "AuditEvent", "resultType": "Success", "resultSignature": "OK", "resultDescription": "", "durationMs": "33", "callerIpAddress": "203.0.113.66", "correlationId": "90000000-0000-4000-8000-000100001000", "identity": { "claim": { "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation" } }, "properties": { "id": "https://kv-bowtruckle-prod.vault.azure.net/secrets/bowtruckle-prod-db-password", "clientInfo": "python/3.11.6 (Linux-5.15.0-1052-aws-x86_64-with-glibc2.35) AZURECLI/2.56.0 (DEB)", "requestUri": "https://kv-bowtruckle-prod.vault.azure.net/secrets/bowtruckle-prod-db-password?api-version=7.4", "httpStatusCode": 200 }, "tenantId": "10000000-0000-4000-8000-000000000001"}MITRE ATT&CK Mapping
Tactics: Impact
Techniques:
- T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...