Check ID: storage_ensure_soft_delete_is_enabled
Provider: Azure
Service: storage
Severity: MEDIUM
Categories: resilience
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts have container soft delete enabled via a retention policy that keeps deleted containers for a set period.

Risk

Without this, container deletions are permanent, reducing availability and integrity. A compromised user or faulty automation could erase entire datasets, forcing slow restores from backups and extending RTO/RPO, with potential downstream app outages.

Recommendation

Enable container soft delete and choose a retention window (7-365 days) that meets your RPO. Pair with blob soft delete and versioning for layered recovery. Enforce least privilege on delete actions and apply resource locks to prevent destructive changes.

Remediation

az storage account blob-service-properties update —resource-group <example_resource_name> —account-name <example_resource_name> —enable-container-delete-retention true —container-delete-retention-days 7

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_ensure_soft_delete_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks