Storage account Blob services should have classic logging enabled
This control verifies that classic logging is enabled for the Azure Blob service. Classic logging captures read, write, and delete operations and stores them in a storage account for auditing and troubleshooting.
Classic logging captures read, write, and delete operations and stores them in a storage account for auditing and troubleshooting.
What this control checks
Classic logging on the Blob service of Azure storage accounts
Common pitfalls
Azure Monitor is recommended for newer resources
While Azure Monitor diagnostic settings are the recommended approach for newer resources, some legacy environments may still rely on classic logging for operational visibility.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.storage_account_blob_service_classic_logging_enabled.
Framework-specific interpretation
CIS Azure Benchmark v1.3.0: Mapped to 3.10 (Ensure Storage logging is enabled for Blob service for read, write, and delete requests).
CIS Azure Benchmark v1.4.0: Mapped to 3.10 (Ensure Storage logging is enabled for Blob service for 'Read', 'Write', and 'Delete' requests).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.10 Ensure Storage logging is enabled for Blob service for read, write, and delete requests
- 3.10 Ensure Storage logging is enabled for Blob service for 'Read', 'Write', and 'Delete' requests
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_blob_service_classic_logging_enabled - Powerpipe Control:
azure_compliance.control.storage_account_blob_service_classic_logging_enabled
Last reviewed: 2026-10-15