Azure file shares should have soft delete enabled
Azure Storage file shares should have soft delete with a retention period (days). The check determines if the storage account's file service has this setting enabled. Soft delete allows recovery of data mistakenly deleted by an application or user.
Without soft delete, deletions are irreversible, reducing availability and integrity. Destructive deletes can magnify ransomware impact and block timely recovery.
What this control checks
File service has soft delete enabled with a retention period (days) for file shares
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_ensure_file_shares_soft_delete_is_enabled (prowler azure --checks storage_ensure_file_shares_soft_delete_is_enabled); PowerPipe control azure_compliance.control.storage_account_file_share_soft_delete_enabled.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - File Share Without Soft Delete" (54087baa-8719-48a8-8460-9cc0962117aa).
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.1.1 (Ensure soft delete for Azure File Shares is Enabled).
CIS Azure Benchmark v5.0.0: Mapped to 9.1.1 (Ensure soft delete for Azure File Shares is Enabled).
RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-12 (Annex I (12) - Take periodic back up of the important data and store this data 'off line' (i.e., transferring important...).
BSI C5:2025: Mapped to PI-03.02B (The deletion procedures prevent recovery by state-of-the-art forensic means.).
HIPAA Security Rule 2003: Mapped to 164.308(a)(7)(i) (Contingency plan) and 164.308(a)(7)(ii)(A) (Data backup plan).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.1.1 Ensure soft delete for Azure File Shares is Enabled
- 9.1.1 Ensure soft delete for Azure File Shares is Enabled
RBI Cyber Security Framework for UCBs
- Annex I (12)
- PI-03.02B The deletion procedures prevent recovery by state-of-the-art forensic means.
- 164.308(a)(7)(i) Contingency plan
- 164.308(a)(7)(ii)(A) Data backup plan
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_file_share_soft_delete_enabled - Powerpipe Control:
azure_compliance.control.storage_account_file_share_soft_delete_enabled - Prowler Check:
storage_ensure_file_shares_soft_delete_is_enabled - KICS Query:
54087baa-8719-48a8-8460-9cc0962117aa
Last reviewed: 2026-10-15