Can't change anything in Encryption after deleting a vault key

Question

I deleted a key vault that was used in a storage account.

Now if I try to change anything in the Encryption section of the storage (like change the encryption type or using a new key), I am getting:

The operation failed because the specified key vault key 'https://dev-certs2.vault.azure.net/keys/<my-previous-key/xxxxxxxxxxxxxxxx' was not found

Is there a way to change it without having to create a new storage account?

Answer 1

By default, the Soft delete will be enabled when you create the keyvault, the default retention period is 90 days, if your keyvault was deleted within 90 days, then you can follow the steps below, if it exceeds 90 days, there seems to be no way to do that without creating a new storage account.(not 100% sure, you may need to contact the azure support)

1.Use powershell to check if the keyvault was in Removed state, if there is no output, it means that exceeds 90 days.

Get-AzKeyVault -VaultName joyk -Location <the same location with the storage> -InRemovedState

2.Use powrershell to recover the previously deleted keyvault.

Undo-AzKeyVaultRemoval -VaultName joyk -ResourceGroupName <group-name> -Location <the same location with the storage>

3.Navigate to the storage account in the portal -> Encryption , you will be able to change the Encryption type or use a new key. After configuring, then you can delete the keyvault again.