title: Azure ML MSI deployment over ARM Templates enables purge protection on Key Vault
body: <p>I have discovered lately that when you deploy an <code>Azure ML</code> instance from the <code>ARM Template</code>, the <code>MSI</code> will override the purge protection settings of the <code>Key Vault</code>. It will enable purge protection on the <code>Key Vault</code>. This is not the behavior that I am looking for, because when trying to deploy it again, the template will fail saying that the <code>Key Vault</code> with the name already exists and you can't deleted before the retention period.</p>
  <p>If you deploy the <code>Azure ML</code> instance manually and select the Key Vault, it will keep the disable purge settings. Any ideas how can we keep purge disabled hier?</p>
  <p>The Azure ML properties that we used are mentioned bellow:</p>
  <pre><code>  {
      &quot;type&quot;: &quot;Microsoft.MachineLearningServices/workspaces&quot;,
      &quot;apiVersion&quot;: &quot;2020-09-01-preview&quot;,
      &quot;name&quot;: &quot;[variables('machineLearningWorkspaceName')]&quot;,
      &quot;location&quot;: &quot;[parameters('location')]&quot;,
      &quot;identity&quot;: {
        &quot;type&quot;: &quot;[parameters('amlManagedIdentityOption')]&quot;
      },
      &quot;dependsOn&quot;: [
        &quot;[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]&quot;,
        &quot;[resourceId('Microsoft.Insights/components', variables('applicationInsightsName'))]&quot;,
        &quot;[resourceId('Microsoft.ContainerRegistry/registries', variables('containerRegistryName'))]&quot;
      ],
      &quot;tags&quot;: &quot;[parameters('resourceTags')]&quot;,
      &quot;properties&quot;: {
        &quot;friendlyName&quot;: &quot;[variables('machineLearningWorkspaceName')]&quot;,
        &quot;storageAccount&quot;: &quot;[variables('storageAccount')]&quot;,
        &quot;keyVault&quot;: &quot;[variables('keyVault')]&quot;,
        &quot;applicationInsights&quot;: &quot;[variables('applicationInsights')]&quot;,
        &quot;containerRegistry&quot;: &quot;[ variables('containerRegistry')]&quot;,
        &quot;adbWorkspace&quot;: &quot;[variables('adbWorkSpace')]&quot;,
        &quot;hbiWorkspace&quot;: &quot;[parameters('confidential_data')]&quot;,
        &quot;allowPublicAccessWhenBehindVnet&quot;: &quot;[parameters('allowPublicAccessWhenBehindVnet')]&quot;
      }
    }
  </code></pre>
  <p>On the Key Vault ARM we have the following properties:</p>
  <pre><code>         &quot;properties&quot;: {
                   &quot;enabledForDeployment&quot;: &quot;[parameters('enabledForDeployment')]&quot;,
                   &quot;enabledForTemplateDeployment&quot;: &quot;[parameters('enabledForTemplateDeployment')]&quot;,
                   &quot;enabledForVolumeEncryption&quot;: &quot;[parameters('enableVaultForVolumeEncryption')]&quot;,
                   &quot;softDeleteRetentionInDays&quot;: 7,
                   &quot;tenantId&quot;: &quot;[subscription().tenantId]&quot;,
                   &quot;copy&quot;: [
                       {
                           &quot;name&quot;: &quot;accessPolicies&quot;,
                           &quot;count&quot;: &quot;[length(parameters('userObjectId'))]&quot;,
                           &quot;input&quot;: {
                               &quot;tenantId&quot;: &quot;[subscription().tenantId]&quot;,
                               &quot;objectId&quot;: &quot;[parameters('userObjectId')[copyIndex('accessPolicies')].Id]&quot;,
                               &quot;permissions&quot;: &quot;[parameters('userObjectId')[copyIndex('accessPolicies')].Permissions]&quot;
                           }
   }
  </code></pre>
  <p><a href="https://i.stack.imgur.com/Qywye.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Qywye.png" alt="enter image description here" /></a></p>