Azure Compliance ControlsAzure Storage
Storage account blobs should have soft delete enabled
Checks that blob soft delete is enabled on storage accounts. KICS says all `azurerm_storage_account` resources should define a `delete_retention_policy` block for their `blob_properties` to allow data recovery.
What this control checks
KICS check 056d28cc-7ee9-4b12-b2d1-16b7b66db72d flags an azurerm_storage_account with no blob_properties block. It also flags a blob_properties block missing delete_retention_policy. It flags days set to 5, noted as lower than the minimum value (7). It passes days = 49, and an empty delete_retention_policy {}, which defaults to 7 days.
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled
- 9.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_blob_soft_delete_enabled - Powerpipe Controls:
azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled,azure_compliance.control.storage_account_blob_soft_delete_enabled - KICS Query:
056d28cc-7ee9-4b12-b2d1-16b7b66db72d
Last reviewed: 2026-10-15