SQL servers should have 'Auditing' retention set to greater than 90 days
SQL Server Audit Retention should be configured to be greater than 90 days. Checks look at SQL server auditing settings. Prowler evaluates that auditing is enabled and log retention is greater than 90 days.
Without adequate retention or with auditing disabled, activity trails expire too soon, limiting detection and investigation of unauthorized access, data exfiltration, and privilege abuse. This weakens confidentiality and integrity and slows incident response.
What this control checks
Checks the Auditing retention period setting on SQL servers
Common pitfalls
Retention of 0 passes the Azure Policy check
The policy existence condition accepts retentionDays equal to 0 or retentionDays greater than or equal to 90.
Recommended retention is at least 90 days
For incident investigation purposes, we recommend setting the data retention for your SQL Server' auditing to storage account destination to at least 90 days.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "SQL servers with auditing to storage account destination should be configured with 90 days retention or higher" (89099bee-89e0-4b26-a5f4-165451757743); Prowler check sqlserver_auditing_retention_90_days (prowler azure --checks sqlserver_auditing_retention_90_days).
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_24; KICS queries "Small MSSQL Server Audit Retention" (59acb56b-2b10-4c2c-ba38-f2223c3f5cfc) and "Small MSSQL Audit Retention Period" (9c301481-e6ec-44f7-8a49-8ec63e2969ea).
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 3.2.5 (The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised...), 4.1.2.g (required resources, including backups and redundancies;) and 3 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AU-11 (Audit Record Retention).
Framework mappings
The clauses this control is mapped to in each framework.
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 12 Asset management
FedRAMP Moderate Baseline Rev 4
- AU-11: Audit Record Retention
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.
- 4.1.3 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.3 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 5.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.312(b) Audit controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_auditing_retention_period_90 - Checkov Check:
CKV_AZURE_24 - Powerpipe Control:
azure_compliance.control.sql_server_auditing_retention_period_90 - Prowler Check:
sqlserver_auditing_retention_90_days - Azure Policy Definition:
89099bee-89e0-4b26-a5f4-165451757743 - KICS Queries:
59acb56b-2b10-4c2c-ba38-f2223c3f5cfc,9c301481-e6ec-44f7-8a49-8ec63e2969ea
Last reviewed: 2026-10-15