Which TWO settings must be enabled on a vault before its key can be used as a customer-managed key?
- A Soft delete (correct answer)
- B Purge protection (correct answer)
- C Public network access
- D The admin user
- E Multi-region replication
Shortcut: Services that encrypt data with a CMK require both, because purging the key would render the encrypted data permanently unrecoverable. Azure therefore refuses to accept a key from a vault where that is still possible.