#What Should I Do If My Key Vault Has Been Permanently Deleted in Azure?

AvePoint Online Services encryption profile uses Azure Key Vault to encrypt your backup data and tenant-sensitive information (Google Workspace or Microsoft 365 usernames, passwords, etc.). When you use a custom key vault for data encryption, you provide your key vault information in an encryption profile.

If the key vault was deleted in Azure, your data cannot be encrypted in AvePoint Online Services. AvePoint recommends you first contact Microsoft Support to recover your key vault.

The table below shows the influence of the key vault deletion on AvePoint Online Services and other cloud services.

If the key vault cannot be recovered in Azure, you can recover your tenant in AvePoint Online Services to make sure AvePoint Online Services and your cloud services work well. Refer to the steps below:

1. In the Microsoft Entra admin center (or Microsoft Azure portal), create a new key vault. For details, see Create a Key Vault in Azure.

2. Navigate to AvePoint Online Services > Encryption management, and create a new encryption profile. For details, see Create an Encryption Profile.

3. Contact the AvePoint Technical Support team to apply the new encryption profile to your AvePoint Online Services tenant.

   *Note: It takes a while to apply the new encryption profile to your tenant. During this time, no additional operations should be taken in both your AvePoint Online Services tenant and AvePoint cloud service environments until the new encryption profile is successfully applied.

4. AvePoint Online Services cannot decrypt your data that was encrypted before. Once the new encryption profile is successfully applied to your tenant, you need to perform the following actions if your tenant has configured the corresponding settings:

   • Edit your service account profile

   • Re-authorize your app profile

   • Edit the service account pool