Azure Compliance ControlsAzure Storage
Storage accounts should have soft delete enabled
This control checks the `soft delete` setting on Azure storage accounts. Azure Storage should be made recoverable by enabling the `soft delete` configuration, so the check looks at each storage account to confirm that this configuration is enabled.
What this control checks
Storage accounts must define a blob delete_retention_policy so deleted blobs can be recovered.
Framework mappings
The clauses this control is mapped to in each framework.
- 3.8 Ensure soft delete is enabled for Azure Storage
- 3.8 Ensure soft delete is enabled for Azure Storage
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_soft_delete_enabled - Checkov Check:
CKV2_AZURE_38 - Powerpipe Controls:
azure_compliance.control.storage_account_blob_and_container_soft_delete_enabled,azure_compliance.control.storage_account_blob_soft_delete_enabled,azure_compliance.control.storage_account_soft_delete_enabled - Azure Policy Definition:
9fbd64e3-67b8-489b-98e5-fa0007d17e76 - KICS Query:
056d28cc-7ee9-4b12-b2d1-16b7b66db72d
Last reviewed: 2026-10-15