Azure SQL databases should have long-term geo-redundant backup enabled
This policy audits any Azure SQL Database with long-term geo-redundant backup not enabled. The Azure Policy check looks at `Microsoft.Sql/servers/databases` other than `master`. It checks the `backupLongTermRetentionPolicies` retention values.
What this control checks
Azure Policy check d38fc420-0735-4ef3-ac11-c806f651a570 applies to Microsoft.Sql/servers/databases where name is not master. It looks for Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies named default. It passes when weeklyRetention, monthlyRetention or yearlyRetention is not PT0S. The effect defaults to AuditIfNotExists and can be set to Disabled. The Powerpipe control sql_database_long_term_geo_redundant_backup_enabled has the title "Long-term geo-redundant backup should be enabled for Azure SQL Databases".
Framework mappings
The clauses this control is mapped to in each framework.
- CP-6 Alternate Storage Site
- CP-6(1) Separation From Primary Site
NIST Cybersecurity Framework v2.0
- ID.AM-05
- PR.DS-11: Backups of data are created, protected, maintained, and tested.
- PR.IR-03
- RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process.
- RC.RP-02
3 more clauses
- RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.
- RC.RP-04
- RC.RP-05
FedRAMP Moderate Baseline Rev 4
- CP-6 Alternate Storage Sites
- CP-6(1) Separation From Primary Site
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.2 Recovery strategy / Contingency Plan
- 6.3 Backup and Recovery
- CP-6 Alternate Storage Sites
- CP-6(1) Separation From Primary Site
- 1616.09l1Organizational.16-09.l 09.05 Information Back-Up
- 1621.09l2Organizational.1-09.l 09.05 Information Back-Up
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_database_long_term_geo_redundant_backup_enabled - Powerpipe Control:
azure_compliance.control.sql_database_long_term_geo_redundant_backup_enabled - Azure Policy Definition:
d38fc420-0735-4ef3-ac11-c806f651a570
Last reviewed: 2026-10-15