Storage account blobs should have soft delete enabled
Checks that blob soft delete is enabled on storage accounts. KICS says all `azurerm_storage_account` resources should define a `delete_retention_policy` block for their `blob_properties` to allow data recovery.
Enable soft delete for blobs to protect against accidental or malicious deletion of blob data.
What this control checks
Storage accounts must have blob soft delete enabled
Common pitfalls
Days lower than minimum value (7)
The KICS check flags days set to 5 in delete_retention_policy, described as "lower than minimum value (7)".
Missing blob_properties or delete_retention_policy
All 'azurerm_storage_account' resources should define a 'delete_retention_policy' block for their 'blob_properties' to allow data recovery.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe controls azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled and azure_compliance.control.storage_account_blob_soft_delete_enabled.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - Blob Storage Without Soft Delete" (056d28cc-7ee9-4b12-b2d1-16b7b66db72d).
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.2.1 (Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled).
CIS Azure Benchmark v5.0.0: Mapped to 9.2.1 (Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled
- 9.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_blob_soft_delete_enabled - Powerpipe Controls:
azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled,azure_compliance.control.storage_account_blob_soft_delete_enabled - KICS Query:
056d28cc-7ee9-4b12-b2d1-16b7b66db72d
Last reviewed: 2026-10-15