Recovery controls are safeguards that help preserve or restore cloud assets after deletion, tampering, or ransomware-style damage. In Azure and other cloud platforms, they can include soft delete, object versioning, snapshots, backups, retention policies, immutable storage, and separate administrative protections for backup vaults and restore points. Their goal is simple: make it harder for an attacker to permanently erase data or disable the paths needed to bring systems back online.
They matter because modern cloud attacks often target both production resources and the recovery layer. If an intruder can delete storage, remove snapshots, or change permissions on backup systems, restoration becomes much slower or impossible. Strong recovery controls limit that blast radius by isolating backup accounts, requiring independent access, and keeping undeletable or time-delayed copies of critical data. Defenders also need to test restores regularly; a backup only helps if it can be recovered under pressure.