Back to Checks
azure

Storage account has soft delete for containers enabled

storage_ensure_soft_delete_is_enabled
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts have container soft delete enabled via a retention policy that keeps deleted containers for a set period.

Prowler logoProwlerprowler-provider-azure

Risk

Without this, container deletions are permanent, reducing availability and integrity. A compromised user or faulty automation could erase entire datasets, forcing slow restores from backups and extending RTO/RPO, with potential downstream app outages.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_ensure_soft_delete_is_enabled

Recommendation

Enable container soft delete and choose a retention window (7-365 days) that meets your RPO. Pair with blob soft delete and versioning for layered recovery. Enforce least privilege on delete actions and apply resource locks to prevent destructive changes.

Remediation

CLI

az storage account blob-service-properties update --resource-group <example_resource_name> --account-name <example_resource_name> --enable-container-delete-retention true --container-delete-retention-days 7

Terraform

# Enable container soft delete on the storage account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_resource_name>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  blob_properties {
    container_delete_retention_policy {
      enabled = true  # Critical: enables soft delete for containers
      days    = 7     # Required when enabled
    }
  }
}

NativeIaC

// Enable container soft delete on the storage account
resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2023-04-01' = {
  name: '<example_resource_name>/default'
  properties: {
    containerDeleteRetentionPolicy: {
      enabled: true // Critical: enables soft delete for containers
      days: 7       // Required when enabled
    }
  }
}

Other

1In the Azure portal, go to Storage accounts and open <storage account>
2Under Data management, select Data protection
3In the Containers section, turn on Soft delete for containers and set Retention (days) to a value (e.g., 7)
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_ensure_soft_delete_is_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                if storage_account.blob_properties:
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=storage_account
                    )
                    report.subscription = subscription
                    if getattr(
                        storage_account.blob_properties.container_delete_retention_policy,
                        "enabled",
                        False,
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has soft delete enabled."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has soft delete disabled."

                    findings.append(report)
        return findings

References