Skip to content
TheCloud.Events

Microsoft.RecoveryServices/vaults/backupProtectedItems/delete

Azure

Microsoft.RecoveryServices/vaults/backupProtectedItems/delete

service: Azure - Backup
tactics:
Impact Defense Impairment
techniques:
T1485T1685
tags:
Azure Backup

Event

Removes a protected item from Azure Backup, stopping protection and deleting associated backup data.

Security Context

  • Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
  • Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.

Log Source

Azure Activity Log

Sample Event

Adversarial. draco@fantasticlogs.cloud removes the protected item that backs up the production SQL database sqldb-occamy-events from the recovery services vault rsv-phoenix-backup. With the protected item removed, the previously-retained recovery points for this database are deleted — eliminating the rollback option before Draco’s pending SQL database delete.

{
  "authorization": {
    "action": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/delete",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.RecoveryServices/vaults/rsv-phoenix-backup/backupFabrics/Azure/protectionContainers/AzureSqlContainer;sql-occamy-prod-server/protectedItems/AzureSqlDb;sqldb-occamy-events"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "puid": "1003200000000666",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud",
    "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814",
    "uti": "rsvBpiDel212ExampleUti",
    "ver": "1.0"
  },
  "correlationId": "90000000-0000-4000-8000-000100100001",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000100100010",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T18:48:33.4218873Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.RecoveryServices/vaults/rsv-phoenix-backup/backupFabrics/Azure/protectionContainers/AzureSqlContainer;sql-occamy-prod-server/protectedItems/AzureSqlDb;sqldb-occamy-events/events/90000000-0000-4000-8000-000100100010/ticks/638798263134218873",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000100100011",
  "operationName": {
    "value": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/delete",
    "localizedValue": "Stop protection and delete backup data"
  },
  "resourceGroupName": "rg-phoenix-dr",
  "resourceProviderName": {
    "value": "Microsoft.RecoveryServices",
    "localizedValue": "Microsoft.RecoveryServices"
  },
  "resourceType": {
    "value": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
    "localizedValue": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.RecoveryServices/vaults/rsv-phoenix-backup/backupFabrics/Azure/protectionContainers/AzureSqlContainer;sql-occamy-prod-server/protectedItems/AzureSqlDb;sqldb-occamy-events",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T18:48:34.0218002Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.RecoveryServices/vaults/rsv-phoenix-backup/backupFabrics/Azure/protectionContainers/AzureSqlContainer;sql-occamy-prod-server/protectedItems/AzureSqlDb;sqldb-occamy-events",
    "message": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/delete",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": []
}

MITRE ATT&CK Mapping

Tactics: Impact Defense Impairment

Techniques:
  • T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...
  • T1685 — Disable or Modify Tools — Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping spec...
shares T1485 — Data Destruction
DeleteBucket DeleteDBCluster DeleteDBInstance DeleteFileSystem DeleteGlobalCluster DeleteObject DeleteObjects DeleteSnapshot +17 more
shares T1685 — Disable or Modify Tools
ArchiveFindings CreateFilter CreateIPSet DeleteAccessKey DeleteAlarms DeleteBucketPolicy DeleteConfigRule DeleteConfigurationRecorder +55 more