Check ID: sqlserver_auditing_retention_90_days
Provider: Azure
Service: sqlserver
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: microsoft.sql/servers

What this check verifies

Azure SQL Server auditing settings are evaluated to ensure auditing is enabled and log retention is greater than 90 days. It considers the auditing policy state and the configured retention_days value.

Risk

Without adequate retention or with auditing disabled, activity trails expire too soon, limiting detection and investigation of unauthorized access, data exfiltration, and privilege abuse. This weakens confidentiality and integrity and slows incident response.

Recommendation

Enable server-level auditing and set retention above 90 days, aligned with policy needs. Store logs in tamper-resistant, centralized storage, restrict access with least privilege, and integrate alerting and review. Apply defense in depth with continuous monitoring.

Remediation

Set-AzSqlServerAudit -ResourceGroupName <example_resource_name> -ServerName <example_resource_name> -RetentionInDays 91 -LogAnalyticsTargetState Enabled -WorkspaceResourceId <example_resource_id>

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = sqlserver_auditing_retention_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks