Back to Checks
azure

Storage account has soft delete enabled for file shares

storage_ensure_file_shares_soft_delete_is_enabled
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.storage/storageaccounts

Azure Storage file shares have soft delete with a retention period (days). The evaluation determines if the storage account's file service has this setting enabled and records the retention duration applied to all shares.

Prowler logoProwlerprowler-provider-azure

Risk

Without soft delete, deletions are irreversible, reducing availability and integrity. Mistakes or insiders can wipe shares, causing outages, data loss, and lengthy restores. Destructive deletes can magnify ransomware impact and block timely recovery.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_ensure_file_shares_soft_delete_is_enabled

Recommendation

Enable soft delete for all Azure file shares and choose a retention window aligned to RPO/RTO and data criticality (e.g., 7-90 days). Apply least privilege to delete actions, layer snapshots/backup for defense in depth, consider resource locks, and monitor delete events for misuse.

Remediation

CLI

az storage account file-service-properties update --resource-group <resource-group> --account-name <storage-account-name> --enable-delete-retention true --delete-retention-days 7

Terraform

# Enable soft delete for Azure File shares on a storage account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_resource_name>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  share_properties {
    retention_policy {
      enabled = true  # CRITICAL: enables soft delete for file shares
      days    = 7     # required retention period
    }
  }
}

NativeIaC

// Enable soft delete for file shares on a storage account
resource sa 'Microsoft.Storage/storageAccounts@2022-09-01' existing = {
  name: '<example_resource_name>'
}

resource fileSvc 'Microsoft.Storage/storageAccounts/fileServices@2022-09-01' = {
  name: 'default'
  parent: sa
  properties: {
    shareDeleteRetentionPolicy: {
      enabled: true // CRITICAL: turns on soft delete for all file shares in this storage account
      days: 7       // required retention period
    }
  }
}

Other

1In the Azure portal, go to Storage accounts and open <storage-account-name>
2Under Data storage, select File shares
3Set Soft delete to Enabled
4Set Retention period (days) to 7
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_ensure_file_shares_soft_delete_is_enabled(Check):
    def execute(self) -> list:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                if getattr(storage_account, "file_service_properties", None):
                    report = Check_Report_Azure(
                        metadata=self.metadata(),
                        resource=storage_account.file_service_properties,
                    )
                    report.subscription = subscription
                    report.resource_name = storage_account.name
                    report.location = storage_account.location

                    if (
                        storage_account.file_service_properties.share_delete_retention_policy.enabled
                    ):
                        report.status = "PASS"
                        report.status_extended = f"File share soft delete is enabled for storage account {storage_account.name} from subscription {subscription_name} ({subscription}) with a retention period of {storage_account.file_service_properties.share_delete_retention_policy.days} days."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"File share soft delete is not enabled for storage account {storage_account.name} from subscription {subscription_name} ({subscription})."

                    findings.append(report)

        return findings

References