Check ID: storage_blob_versioning_is_enabled
Provider: Azure
Service: storage
Severity: MEDIUM
Categories: resilience
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts have blob versioning enabled (IsVersioningEnabled) to automatically retain previous versions of blobs created by updates or deletes

Risk

Without blob versioning:
  • Integrity: overwrites can’t be reverted
  • Availability: deletes or ransomware remove usable copies
  • Forensics: no immutable history for investigation and scoped recovery
Mistakes or compromised identities can cause irreversible object loss and wider impact.

Recommendation

Enable blob versioning for accounts holding critical data. Pair with blob soft delete and lifecycle rules to retain and age off versions. Enforce least privilege on write and version-delete actions, and monitor access. For high-churn data, isolate into separate accounts with tailored retention to balance security and cost.

Remediation

az storage account blob-service-properties update —resource-group <resource_group> —account-name <storage-account> —enable-versioning true

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_blob_versioning_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks