[Dataprotection] az dataprotection backup-vault deleted-vault: Secure-by-Default and support for soft-deleted Backup Vaults

[zubairabid]

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az dataprotection backup-vault deleted-vault: Command group to handle soft-deleted backup vault operations - show, list, undelete, and list deleted backup instances under such a vault.
aaz: Azure/aaz#920

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[azure-client-tools-bot-prd]

⚠️Azure CLI Extensions Breaking Change Test

⚠️dataprotection

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	dataprotection backup-vault create	cmd dataprotection backup-vault create added parameter x_ms_deleted_vault_id
⚠️ 1011 - SubgroupAdd	dataprotection backup-vault deleted-vault	sub group dataprotection backup-vault deleted-vault added

[azure-client-tools-bot-prd]

Hi @zubairabid,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

[yonzhan]

Thank you for your contribution! We will review the pull request and get back to you soon.

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

[github-actions]

CodeGen Tools Feedback Collection

Thank you for using our CodeGen tool. We value your feedback, and we would like to know how we can improve our product. Please take a few minutes to fill our codegen survey

[github-actions]

• For more info about extension versioning, please refer to Extension version schema

[Copilot]

Pull request overview

This pull request adds support for soft-deleted Backup Vaults with a "Secure-by-Default" approach to the Azure Data Protection CLI extension. The changes introduce a new command group for managing deleted vaults and enforce AlwaysOn soft delete as the default security setting.

Changes:

• New az dataprotection backup-vault deleted-vault command group with operations to list, show, undelete soft-deleted vaults, and list deleted backup instances
• Soft delete state enforced to "AlwaysOn" by default with deprecation warning for --soft-delete-state parameter
• API version upgrade from 2025-07-01 to 2025-09-01

Reviewed changes

Copilot reviewed 77 out of 92 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
manual/custom.py	Implements undelete and list-deleted-backup-instances commands
manual/commands.py	Registers new deleted-vault command group
manual/_params.py	Defines parameters for new commands
manual/_help.py	Adds help documentation for deleted-vault commands
manual/aaz_operations/backup_vault.py	Enforces AlwaysOn soft delete, makes storage_setting optional, adds deprecation warning
manual/backupcenter_helper.py	Adds query helper for deleted backup instances
aaz/latest/dataprotection/restorable_time_range/_find.py	Updates API version to 2025-09-01
aaz/latest/dataprotection/resource_guard/_unlock.py	Updates API version to 2025-09-01
tests/latest/test_dataprotection_deleted_vault.py	Comprehensive new test for deleted vault operations
tests/latest/test_dataprotection_backup_vault.py	Updated tests for AlwaysOn soft delete state
tests/latest/test_dataprotection_backup_instance_restore.py	Skipped test with TODO comment
tests/latest/test_dataprotection_resource_guard.py	Updated test expectation for protected operations count
Recording files	Updated with new API version, timestamps, and test data

[zubairabid]

Heads up - please don't merge and release this yet. We're looking to release this in mid-end February, once the service-side changes are more generally available.