Ransomware reaches the backup admin
An attacker with an admin account can delete recovery points before triggering encryption.
We lock the Recovery Services vault and extend soft delete. Multi User Authorization then means no one changes retention without a second sign off from another tenant.
Clean recovery points survive, because no single account can remove them.
Related work: Azure security for a US healthcare provider