Azure Compliance ControlsAzure Storage
Azure Blob Storage accounts should have soft delete enabled for containers
Azure Storage accounts should have container soft delete enabled via a retention policy that keeps deleted containers for a set period. Without it, container deletions are permanent. Prowler rates this check medium severity.
What this control checks
Storage accounts must have container soft delete enabled with a retention policy (7-365 days).
Framework mappings
The clauses this control is mapped to in each framework.
- C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
2 more clauses
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 4 Business continuity and crisis management
- 12 Asset management
- 10.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled
- 10.3.6 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 9.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled
- 9.2.2 Ensure that soft delete for containers on Azure Blob Storage storage accounts is Enabled
RBI Cyber Security Framework for UCBs
- Annex I (12)
- PI-03.02B The deletion procedures prevent recovery by state-of-the-art forensic means.
- 3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 4.10 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.308(a)(7)(ii)(C) Emergency mode operation plan
- 164.312(a)(2)(ii) Emergency access procedure
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_container_soft_delete_enabled - Powerpipe Controls:
azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled,azure_compliance.control.storage_account_container_soft_delete_enabled - Prowler Check:
storage_ensure_soft_delete_is_enabled - KICS Query:
12ecec8a-7961-48db-b644-86be8845d8fd
Last reviewed: 2026-10-15