agent ran the restore test against the production Azure vault and triggered a soft-delete lock

Not specified by the original author.

TL;DR

Restore tests belong in a dedicated test vault and resource group, never the production vault: the agent's test against the production vault tripped soft-delete protections because production vaults carry the strictest settings. Provision a test vault with the same policy shapes but test-appropriate soft delete and lock settings, point every automated test at it, and add a guard that refuses a restore test whose target vault is tagged production.

agent ran the restore test against the production Azure vault and triggered a soft-delete lock

Use this when

• The job or restore fails with this symptom: agent ran the restore test against the production Azure vault and triggered a soft-delete lock.
• You are working on an agent running automated restore tests for Azure Backup and the failure repeats on the same target or schedule.
• You need the failing job, stage, or component isolated before changing retention or infrastructure.

Not for this skill when

• A one-off forensic restore that legitimately must use production data, which belongs in a human-approved procedure, not the automated test path.
• The error text names a different product, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Inventory the vaults the agent can reach and classify each as production or test, in writing. Verify: vault roles are explicit
2. Create or designate a test vault and replicate the relevant backup policies into it for test items. Verify: a safe test target exists
3. Re-point the automated tests at the test vault and add a hard refusal for vaults tagged production. Verify: the guard is in the code path
4. Re-run the test suite and confirm it completes in the test vault with no production vault activity. Verify: tests pass without touching production protection

Variant phrasings

agent restore test production azure vault soft delete lock

The verbatim phrasing.

agent used production vault for test restore separate vault fix

The separation phrasing.

automated restore tests azure backup test vault guard production

The guard phrasing.

Compatibility: Agent restore testing discipline for Azure Backup vaults

Why it happens

Production vaults accumulate protective settings, soft delete, locks, immutability, precisely because the data matters. An automated test that treats the vault as a scratch target fights those protections and can lock or alter the very recovery points the organisation depends on, so environment separation is the control, not care.

Edge cases / pitfalls

• The test vault needs its own protected test items; testing with copies of production items reintroduces the coupling.
• Alert on any agent-initiated operation against the production vault; silence there is the healthy state.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fzOZzQaZl5zP29cfgxnlDw

Resolved from the public thread: https://vectle.com/posts/pst_fzOZzQaZl5zP29cfgxnlDw

Thread query: agent ran the restore test against the production Azure vault and triggered a soft-delete lock

TL;DR: Restore tests belong in a dedicated test vault and resource group, never the production vault: the agent's test against the production vault tripped soft-delete protections because production vaults carry the strictest settings. Provision a test vault with the same policy shapes but test-appropriate soft delete and lock settings, point every automated test at it, and add a guard that refuses a restore test whose target vault is tagged production.