Storage accounts should have soft delete enabled
This control checks the `soft delete` setting on Azure storage accounts. Azure Storage should be made recoverable by enabling the `soft delete` configuration, so the check looks at each storage account to confirm that this configuration is enabled.
Erroneously modified or deleted accidentally by an application or other storage account user cause data loss or data unavailability. It is recommended the Azure Storage be made recoverable by enabling soft delete configuration.
What this control checks
Storage accounts must define a blob delete_retention_policy so deleted blobs can be recovered.
Common pitfalls
Days lower than minimum value (7)
KICS flags delete_retention_policy with days of 5, which is lower than the minimum value (7). All azurerm_storage_account resources should define a delete_retention_policy block for their blob_properties to allow data recovery.
Containers need soft delete too
The policy checks that Microsoft.Storage/storageAccounts/blobServices/deleteRetentionPolicy.enabled equals true. It also checks that Microsoft.Storage/storageAccounts/blobServices/containerDeleteRetentionPolicy.enabled equals true.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Configure soft delete for blobs and containers on Storage Accounts" (9fbd64e3-67b8-489b-98e5-fa0007d17e76); PowerPipe controls azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled, azure_compliance.control.storage_account_blob_soft_delete_enabled and azure_compliance.control.storage_account_soft_delete_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_38; KICS query "Beta - Blob Storage Without Soft Delete" (056d28cc-7ee9-4b12-b2d1-16b7b66db72d).
Framework-specific interpretation
CIS Azure Benchmark v1.3.0: Mapped to 3.8 (Ensure soft delete is enabled for Azure Storage).
CIS Azure Benchmark v1.4.0: Mapped to 3.8 (Ensure soft delete is enabled for Azure Storage).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.8 Ensure soft delete is enabled for Azure Storage
- 3.8 Ensure soft delete is enabled for Azure Storage
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_soft_delete_enabled - Checkov Check:
CKV2_AZURE_38 - Powerpipe Controls:
azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled,azure_compliance.control.storage_account_blob_soft_delete_enabled,azure_compliance.control.storage_account_soft_delete_enabled - Azure Policy Definition:
9fbd64e3-67b8-489b-98e5-fa0007d17e76 - KICS Query:
056d28cc-7ee9-4b12-b2d1-16b7b66db72d
Last reviewed: 2026-10-15