Check ID: storage_ensure_file_shares_soft_delete_is_enabled
Provider: Azure
Service: storage
Severity: MEDIUM
Categories: resilience
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage file shares have soft delete with a retention period (days). The evaluation determines if the storage account’s file service has this setting enabled and records the retention duration applied to all shares.

Risk

Without soft delete, deletions are irreversible, reducing availability and integrity. Mistakes or insiders can wipe shares, causing outages, data loss, and lengthy restores. Destructive deletes can magnify ransomware impact and block timely recovery.

Recommendation

Enable soft delete for all Azure file shares and choose a retention window aligned to RPO/RTO and data criticality (e.g., 7-90 days). Apply least privilege to delete actions, layer snapshots/backup for defense in depth, consider resource locks, and monitor delete events for misuse.

Remediation

az storage account file-service-properties update —resource-group <resource-group> —account-name <storage-account-name> —enable-delete-retention true —delete-retention-days 7

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_ensure_file_shares_soft_delete_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks