Key vault should have purge protection enabled

Malicious deletion of a key vault can lead to permanent data loss. A malicious insider in your organization may potentially be able to gain access to delete and purge key vaults. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft will be able to purge your key vaults during the soft delete retention period.