Back to Checks
azure

Storage account has blob versioning enabled

storage_blob_versioning_is_enabled
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts have blob versioning enabled (IsVersioningEnabled) to automatically retain previous versions of blobs created by updates or deletes

Prowler logoProwlerprowler-provider-azure

Risk

Without blob versioning:

  • Integrity: overwrites can't be reverted
  • Availability: deletes or ransomware remove usable copies
  • Forensics: no immutable history for investigation and scoped recovery

Mistakes or compromised identities can cause irreversible object loss and wider impact.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_blob_versioning_is_enabled

Recommendation

Enable blob versioning for accounts holding critical data. Pair with blob soft delete and lifecycle rules to retain and age off versions. Enforce least privilege on write and version-delete actions, and monitor access. For high-churn data, isolate into separate accounts with tailored retention to balance security and cost.

Remediation

CLI

az storage account blob-service-properties update --resource-group <resource_group> --account-name <storage-account> --enable-versioning true

Terraform

# Enable blob versioning on a Storage Account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_resource_name>"
  sku_name            = "Standard_LRS"

  blob_properties {
    versioning_enabled = true # Critical: enables blob versioning to pass the check
  }
}

NativeIaC

// Enable blob versioning on an existing storage account
resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2023-01-01' = {
  name: '<example_resource_name>/default'
  properties: {
    isVersioningEnabled: true // Critical: enables blob versioning to pass the check
  }
}

Other

1In the Azure portal, go to Storage accounts and open your storage account
2Under Data management, select Data protection
3In Tracking, set Enable versioning for blobs to Enabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_blob_versioning_is_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                if storage_account.blob_properties:
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=storage_account
                    )
                    report.subscription = subscription
                    if getattr(
                        storage_account.blob_properties, "versioning_enabled", False
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has blob versioning enabled."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) does not have blob versioning enabled."
                    findings.append(report)
        return findings

References