Azure Blob Storage accounts should have soft delete enabled for containers
Azure Storage accounts should have container soft delete enabled via a retention policy that keeps deleted containers for a set period. Without it, container deletions are permanent. Prowler rates this check medium severity.
Without this, container deletions are permanent, reducing availability and integrity. A compromised user or faulty automation could erase entire datasets, forcing slow restores from backups and extending RTO/RPO, with potential downstream app outages.
What this control checks
Storage accounts must have container soft delete enabled with a retention policy (7-365 days).
Common pitfalls
Retention days below the minimum value
days = 5 is flagged as "lower than minimum value (7)".
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_ensure_soft_delete_is_enabled (prowler azure --checks storage_ensure_soft_delete_is_enabled); PowerPipe controls azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled and azure_compliance.control.storage_account_container_soft_delete_enabled.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - Containers Without Soft Delete" (12ecec8a-7961-48db-b644-86be8845d8fd).
Framework-specific interpretation
SOC 2: Mapped to C1.1 (The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality) and PI1.5 (Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's...).
PCI DSS v4.0: Mapped to 10.3.2 (Audit logs are protected from destruction and unauthorized modifications.), 3.5.1.3 (Primary account number (PAN) is secured wherever it is stored.), 8.4.1 (Multi-factor authentication (MFA) is implemented to secure access into the CDE.) and 4 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...) and 4.2.2.f (retention periods based on business and regulatory requirements.).
Framework mappings
The clauses this control is mapped to in each framework.
- C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
2 more clauses
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 4 Business continuity and crisis management
- 12 Asset management
- 10.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled
- 10.3.6 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 9.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled
- 9.2.2 Ensure that soft delete for containers on Azure Blob Storage storage accounts is Enabled
RBI Cyber Security Framework for UCBs
- Annex I (12)
- PI-03.02B The deletion procedures prevent recovery by state-of-the-art forensic means.
- 3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 4.10 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.308(a)(7)(ii)(C) Emergency mode operation plan
- 164.312(a)(2)(ii) Emergency access procedure
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_container_soft_delete_enabled - Powerpipe Controls:
azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled,azure_compliance.control.storage_account_container_soft_delete_enabled - Prowler Check:
storage_ensure_soft_delete_is_enabled - KICS Query:
12ecec8a-7961-48db-b644-86be8845d8fd
Last reviewed: 2026-10-15