Azure Compliance ControlsAzure Network Watcher
Network security group flow logs should have retention set to greater than 90 days
Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days.
What this control checks
Checks the retention period setting on network security group flow logs
Framework mappings
The clauses this control is mapped to in each framework.
- 8.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 7.5 Ensure that network security group flow log retention days is set to greater than or equal to 90
- 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- 7.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
Related controls
- Flow log resources should have flow logging enabled
- Network security groups should limit inbound TCP port 1433 access from the internet
- Network security groups should limit inbound TCP port 5900 access from the internet
- Azure subscriptions should have at least one Azure Bastion host
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_sg_flowlog_retention_period_greater_than_90 - Checkov Check:
CKV_AZURE_12 - Powerpipe Control:
azure_compliance.control.network_sg_flowlog_retention_period_greater_than_90
Last reviewed: 2026-10-14