Enable purge protection on key-vault-certificate-create vault

Adds enablePurgeProtection: true to the vault in key-vault-certificate-create/main.bicep
(and the regenerated azuredeploy.json).

Without purge protection, soft-deleted vault contents can be permanently
destroyed during the soft-delete retention window. Enabling purge
protection guarantees the configured retention window is honored, which
is the recommended Key Vault security baseline.

Validation:
- correlationId: 05435e1e-63f6-4269-98b1-42955d84a56a
- deploymentName: kvcrt-deploy-29b9ab41
- region: eastus
- provisioningState: Succeeded

metadata.json updated with validationType: Manual and the
testResult.deployments block.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: msmbaldwin

quickstarts/microsoft.keyvault/key-vault-certificate-create/azuredeploy.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.42.1.51946",
-      "templateHash": "14056312705210722600"
+      "templateHash": "11850030662128066774"
     }
   },
   "parameters": {
@@ -66,6 +66,7 @@
         "enableRbacAuthorization": true,
         "enableSoftDelete": true,
         "softDeleteRetentionInDays": 90,
+        "enablePurgeProtection": true,
         "enabledForDeployment": false,
         "enabledForDiskEncryption": false,
         "enabledForTemplateDeployment": false,

quickstarts/microsoft.keyvault/key-vault-certificate-create/main.bicep

@@ -29,6 +29,7 @@ resource vault 'Microsoft.KeyVault/vaults@2023-07-01' = {
     enableRbacAuthorization: true
     enableSoftDelete: true
     softDeleteRetentionInDays: 90
+    enablePurgeProtection: true
     enabledForDeployment: false
     enabledForDiskEncryption: false
     enabledForTemplateDeployment: false

quickstarts/microsoft.keyvault/key-vault-certificate-create/metadata.json

@@ -6,5 +6,13 @@
   "summary": "This template creates a Key Vault with Azure RBAC authorization and a self-signed certificate.",
   "githubUsername": "msmbaldwin",
   "docOwner": "msmbaldwin",
-  "dateUpdated": "2026-04-10"
+  "dateUpdated": "2026-05-13",
+  "validationType": "Manual",
+  "testResult": {
+    "deployments": {
+      "templateFileName": "main.bicep",
+      "correlationId": "05435e1e-63f6-4269-98b1-42955d84a56a",
+      "deploymentName": "kvcrt-deploy-29b9ab41"
+    }
+  }
 }