Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
storage_ensure_file_shares_soft_delete_is_enabledProvider: Azure
Service:
storageSeverity: MEDIUM
Categories:
resilienceResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage file shares have soft delete with a retention period (days). The evaluation determines if the storage account’s file service has this setting enabled and records the retention duration applied to all shares.
Risk
Without soft delete, deletions are irreversible, reducing availability and integrity. Mistakes or insiders can wipe shares, causing outages, data loss, and lengthy restores. Destructive deletes can magnify ransomware impact and block timely recovery.Recommendation
Enable soft delete for all Azure file shares and choose a retention window aligned toRPO/RTO and data criticality (e.g., 7-90 days). Apply least privilege to delete actions, layer snapshots/backup for defense in depth, consider resource locks, and monitor delete events for misuse.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az storage account file-service-properties update —resource-group <resource-group> —account-name <storage-account-name> —enable-delete-retention true —delete-retention-days 7
References
- https://learn.microsoft.com/en-us/azure/storage/files/storage-files-prevent-file-share-deletion?tabs=azure-portal
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/StorageAccounts/enable-soft-delete-for-file-shares.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_ensure_file_shares_soft_delete_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks