Protecting Azure Backup from malicious deletion

I want to regularly back up a number of Windows servers (all Azure VM's) to an Azure Backup vault. My worry is that if my Azure account is compromised, an attacker could potentially delete the VM's, the storage accounts and the backup vault.

1. Does Azure Backup provide any protection against this scenario?
2. If not, what solution do you recommend? An obvious extra safety measure would be to have a separate Azure account for the backup.

You can use Resource Locks to protect resources from accidental / malicious deletion.

For instance, to apply a lock to a vault, you would use the following

New-AzureRmResourceLock -LockName "VaultLock" -LockLevel CanNotDelete `
                        -ResourceGroupName MyvaultRG `
                        -ResourceName MyVault `
                        -ResourceType Microsoft.KeyVault/vaults

if you then attempt to delete you will get the following error

Remove-AzureRmKeyVault : ScopeLocked: The scope '{scope}' cannot perform delete operation because following scope(s) are locked: {scope}

You need to issue a command to remove the lock in order to delete the resource.

Remove-AzureRmResourceLock -LockName "VaultLock" 

This used in conjunction with RBAC policies can keep your resources secure.