Azure SQL databases should have long-term geo-redundant backup enabled
This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled. The Azure Policy check looks at `Microsoft.Sql/servers/databases` other than `master`. It checks the `backupLongTermRetentionPolicies` retention values.
What this control checks
Azure SQL databases (not master) need a long-term retention policy with weekly, monthly or yearly.
Common pitfalls
The master database is excluded
The policy rule applies to Microsoft.Sql/servers/databases where name notEquals master.
Retention of PT0S fails the check
The existence condition requires weeklyRetention, monthlyRetention or yearlyRetention to be notEquals PT0S.
Effect is AuditIfNotExists by default
The effect parameter has a defaultValue of AuditIfNotExists. The allowedValues are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Long-term geo-redundant backup should be enabled for Azure SQL Databases" (d38fc420-0735-4ef3-ac11-c806f651a570); PowerPipe control azure_compliance.control.sql_database_long_term_geo_redundant_backup_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CP-6 (Alternate Storage Site) and CP-6(1) (Separation from Primary Site).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-05 (Assets are prioritized based on classification, criticality, resources, and impact on the mission.), PR.DS-11 (Backups of data are created, protected, maintained, and tested.), PR.IR-03 (Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.) and 5 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to CP-6 (Alternate Storage Sites) and CP-6(1) (Separation From Primary Site).
Framework mappings
The clauses this control is mapped to in each framework.
- CP-6 Alternate Storage Site
- CP-6(1) Separation From Primary Site
NIST Cybersecurity Framework v2.0
- ID.AM-05
- PR.DS-11: Backups of data are created, protected, maintained, and tested.
- PR.IR-03
- RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process.
- RC.RP-02
3 more clauses
- RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.
- RC.RP-04
- RC.RP-05
FedRAMP Moderate Baseline Rev 4
- CP-6 Alternate Storage Sites
- CP-6(1) Separation From Primary Site
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.2 Recovery strategy / Contingency Plan
- 6.3 Backup and Recovery
- CP-6 Alternate Storage Sites
- CP-6(1) Separation From Primary Site
- 1616.09l1Organizational.16-09.l 09.05 Information Back-Up
- 1621.09l2Organizational.1-09.l 09.05 Information Back-Up
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_database_long_term_geo_redundant_backup_enabled - Powerpipe Control:
azure_compliance.control.sql_database_long_term_geo_redundant_backup_enabled - Azure Policy Definition:
d38fc420-0735-4ef3-ac11-c806f651a570
Last reviewed: 2026-10-15