Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
storage_ensure_soft_delete_is_enabledProvider: Azure
Service:
storageSeverity: MEDIUM
Categories:
resilienceResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage accounts have container soft delete enabled via a retention policy that keeps deleted containers for a set period.Risk
Without this, container deletions are permanent, reducing availability and integrity. A compromised user or faulty automation could erase entire datasets, forcing slow restores from backups and extending RTO/RPO, with potential downstream app outages.Recommendation
Enable container soft delete and choose a retention window (7-365 days) that meets your RPO. Pair with blob soft delete and versioning for layered recovery. Enforce least privilege on delete actions and apply resource locks to prevent destructive changes.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az storage account blob-service-properties update —resource-group <example_resource_name> —account-name <example_resource_name> —enable-container-delete-retention true —container-delete-retention-days 7
References
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/StorageAccounts/enable-soft-delete.html#
- https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview
- https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_ensure_soft_delete_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks