Need to have help removing immutability lock so that I can modify the data retention schedule

Question

I have one vault for which I enabled immutability before understanding that I needed to modify the data retention policy before making the final change.

Answer 1

Hi @marcj ,

while enabling the "Immutable vault" option did you enable "Locked" option as well?

If so, the "Immutable vault" option can't be reverted.

Source: Enable Immutable vault

You should have seen a warning message when you enable the "Locked" option.

There are two options if the "Immutable vault" option is "Locked":

Wait until the retention period of the backups are expired and try to modify the setting or open a support request with Azure Support.

---

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Answer 2

in my case I had to contact Azure support

Answer 3

Hello marcj, We Understand that you enabled immutability on an Azure Recovery Services Vault and later realized that the backup retention policy needs to be modified. However, because immutability was enabled (and possibly locked), you are now unable to change the retention settings and want to know whether the immutability lock can be removed.

Azure Backup immutability uses WORM (Write Once, Read Many) storage. When the immutability lock is applied:

• Azure permanently prevents any operation that could delete or reduce backup data.
• Even subscription owners or Azure Support cannot override or remove the lock.

Because of this security guarantee, Azure intentionally does not provide any mechanism to unlock or roll back a locked immutable vault.

Increase retention: What you are allowed is you can Increase retention if the increasing the retention of backup items that are in not in suspended state.

You may increase the retention period, but you cannot decrease it while immutability is locked.

How to manage Azure Backup Immutable vault operations - Azure Backup | Microsoft Learn

Wait for retention to expire: All existing recovery points must fully expire based on the current retention. After that, you can stop protection and move workloads elsewhere.

Create a new vault: Create a new Recovery Services Vault.

• Configure the correct retention policy first.
• Enable immutability only after validating the policy.
• Start fresh backups to the new vault.

Hope this helps! If you encounter any issues, please reach out to us. Thanks.