Azure Compliance ControlsAzure Storage
Storage account Queue services should have classic logging enabled
This control ensures that classic logging is enabled for the Azure Queue service. It validates whether operations such as enqueue, dequeue, and delete are being captured via the legacy storage logging mechanism. This is especially relevant for older deployments where diagnostic settings are not configured.
What this control checks
Enforcement is evaluated per storage account against the settings of its Queue service.
Framework mappings
The clauses this control is mapped to in each framework.
- 3.3 Ensure Storage logging is enabled for Queue service for read, write, and delete requests
- 3.3 Ensure Storage logging is enabled for Queue service for 'Read', 'Write', and 'Delete' requests
Related controls
- Storage accounts should have soft delete enabled for both blobs and containers
- Storage accounts should use customer-managed key for encryption
- Storage accounts should use Azure Resource Manager resources
- Network security groups should have Diagnostic Settings configured
- SMB file shares should have 'SMB channel encryption' set to 'AES-256-GCM' or higher
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_queue_service_classic_logging_enabled - Checkov Check:
CKV_AZURE_33 - Powerpipe Control:
azure_compliance.control.storage_account_queue_service_classic_logging_enabled
Last reviewed: 2026-10-15