Azure Compliance ControlsAzure SQL Database
SQL servers should have 'Auditing' retention set to greater than 90 days
SQL Server Audit Retention should be configured to be greater than 90 days. Checks look at SQL server auditing settings. Prowler evaluates that auditing is enabled and log retention is greater than 90 days.
What this control checks
Checks the Auditing retention period setting on SQL servers
Framework mappings
The clauses this control is mapped to in each framework.
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 12 Asset management
FedRAMP Moderate Baseline Rev 4
- AU-11: Audit Record Retention
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.
- 4.1.3 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.3 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 5.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.312(b) Audit controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_auditing_retention_period_90 - Checkov Check:
CKV_AZURE_24 - Powerpipe Control:
azure_compliance.control.sql_server_auditing_retention_period_90 - Prowler Check:
sqlserver_auditing_retention_90_days - Azure Policy Definition:
89099bee-89e0-4b26-a5f4-165451757743 - KICS Queries:
59acb56b-2b10-4c2c-ba38-f2223c3f5cfc,9c301481-e6ec-44f7-8a49-8ec63e2969ea
Last reviewed: 2026-10-15