# Ensure Immutability for Recovery Services Vaults is Enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000234844-ensure-immutability-for-recovery-services-vaults-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** Level 1

**Description:** Immutability on Azure Recovery Services Vaults ensures that backup data and recovery points cannot be altered or deleted within a specified retention period. This write-once-read-many (WORM) protection safeguards backups against accidental or malicious tampering, including ransomware attacks, maintaining data integrity and availability.

**Rationale:** Enabling immutability strengthens data protection and compliance by guaranteeing that backup data remains unchangeable for the retention period. This is critical for business continuity, regulatory requirements, and audit readiness, ensuring reliable recovery points in case of data loss or corruption.

**Impact:**

-   Pros:  
    
    -   Protects backups from deletion or modification.  
        
    -   Mitigates risks from ransomware and insider threats.  
        
    -   Supports compliance with data retention and audit regulations.  
        
-   Cons:  
    
    -   Requires careful planning of retention durations.  
        
    -   Immutability periods are non-reversible for existing backups.  
        
    -   Potentially higher storage costs due to enforced retention.  
        

**Default Value:** Immutability is disabled by default and must be explicitly enabled and configured on Recovery Services Vaults.

-   Azure Recovery Services Vault configured with backup enabled.  
    
-   Permissions to manage immutability settings.  
    
-   Defined organizational retention and compliance policies.  
    

### **Remediation**

**Test Plan:**

**Using Azure Portal:**

1.  Navigate to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Open Recovery Services Vaults and select the target vault.  
    
3.  Under Backup Policies or Immutability Settings, verify that immutability is enabled and configured with an appropriate retention period.  
    

**Using Azure CLI:**

1\. Retrieve immutability settings for the backup policy:  

az backup policy show --resource-group <resource-group> --vault-name <vault-name> --name <policy-name> --query immutabilitySettings

2\. Confirm that immutability is enabled and retention duration is set.  

### **Implementation Plan**

**Using Azure Portal:**

1.  Create or update a backup policy with immutability enabled.  
    
2.  Specify the retention duration according to policy.  
    
3.  Assign the policy to relevant backup items or workloads.  
    
4.  Save and verify the settings.  
    

**Using Azure CLI:**

1\. Enable immutability in a backup policy:  

az backup policy set --resource-group <resource-group> --vault-name <vault-name> --name <policy-name> --set immutabilitySettings.enabled=true immutabilitySettings.retentionDurationInDays=<days>

2\. Apply the policy to backup items as necessary.  

### **Backout Plan**

**Using Azure Portal:**

1.  Disable immutability in the backup policy if required.  
    
2.  Note that immutability cannot be revoked for existing immutable backups.  
    

**Using Azure CLI:**

1\. Disable immutability:  

az backup policy set --resource-group <resource-group> --vault-name <vault-name> --name <policy-name> --set immutabilitySettings.enabled=false

2\. Existing immutable backups remain unaffected.  

**References:**

-   [Azure Backup Immutability Overview  
    ](https://learn.microsoft.com/en-us/azure/backup/backup-azure-immutability-overview)
    
-   [Configure Immutability for Recovery Services Vault](https://learn.microsoft.com/en-us/azure/backup/backup-azure-immutable-vault)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.