Storage accounts should have soft delete enabled for both blobs and containers
The powerpipe check "Ensure Soft Delete is Enabled for Azure Containers and Blob Storage" covers Azure Storage accounts. The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal.
The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal.
What this control checks
Soft delete must be enabled for Azure containers and blob storage
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.3.6 (Ensure Soft Delete is Enabled for Azure Containers and Blob Storage).
CIS Azure Benchmark v1.5.0: Mapped to 3.11 (Ensure Soft Delete is Enabled for Azure Containers and Blob Storage).
CIS Azure Benchmark v2.0.0: Mapped to 3.11 (Ensure Soft Delete is Enabled for Azure Containers and Blob Storage).
CIS Azure Benchmark v2.1.0: Mapped to 3.11 (Ensure Soft Delete is Enabled for Azure Containers and Blob Storage).
CIS Azure Benchmark v3.0.0: Mapped to 4.10 (Ensure Soft Delete is Enabled for Azure Containers and Blob Storage).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.3.6 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 4.10 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_blob_and_container_soft_delete_enabled - Powerpipe Control:
azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled
Last reviewed: 2026-10-15