Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
storage_blob_versioning_is_enabledProvider: Azure
Service:
storageSeverity: MEDIUM
Categories:
resilienceResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage accounts have blob versioning enabled (IsVersioningEnabled) to automatically retain previous versions of blobs created by updates or deletes
Risk
Without blob versioning:- Integrity: overwrites can’t be reverted
- Availability: deletes or ransomware remove usable copies
- Forensics: no immutable history for investigation and scoped recovery
Recommendation
Enable blob versioning for accounts holding critical data. Pair with blob soft delete and lifecycle rules to retain and age off versions. Enforce least privilege on write and version-delete actions, and monitor access. For high-churn data, isolate into separate accounts with tailored retention to balance security and cost.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az storage account blob-service-properties update —resource-group <resource_group> —account-name <storage-account> —enable-versioning true
References
- https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-overview
- https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-enable
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/StorageAccounts/enable-versioning-for-blobs.html
- https://learn.microsoft.com/en-us/azure/storage/blobs/versions-manage-dotnet
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_blob_versioning_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks