# Ensure Soft Delete is Enabled for Azure Containers and Blob Storage

- Source: https://support.icompaas.com/support/solutions/articles/62000219789-ensure-soft-delete-is-enabled-for-azure-containers-and-blob-storage
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [3. Storage Accounts](https://support.icompaas.com/support/solutions/folders/62000167546)
- Last updated: 2026-06-15
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description: 

Soft delete for Azure Blob Storage allows you to recover deleted blobs and containers within a retention period. When soft delete is enabled, deleted blobs and containers are retained in a "soft deleted" state for a specified duration before being permanently removed. This feature is crucial for protecting against accidental or malicious deletion of critical data, enabling data recovery, and enhancing compliance with data retention requirements.

  

Rationale: 

Enabling Soft Delete for Azure Containers and Blob Storage provides an additional layer of data protection. It ensures that deleted blobs and containers can be restored within the retention period, preventing data loss due to human error or unforeseen circumstances. This is especially important for compliance with industry regulations such as GDPR, HIPAA, and SOC 2, which require data protection measures and retention policies to be in place.

  

Impact: 

Enabling Soft Delete ensures that deleted blobs or containers are retained for a configurable period (usually 7 to 365 days), which increases storage costs because soft-deleted blobs continue to occupy space. However, the tradeoff is that it provides a safeguard against data loss, making it a valuable security feature.

  

Default Value: 

Blob soft delete is enabled by default when you create a new storage account with the Azure portal. The setting to enable or disable blob soft delete when you create a new storage account is in the Data Protection.

  

Pre-requisites:

-   Global Administrator or Security Administrator permissions
    

  

Test Plan:

1.  Log in to the Azure Portal.
    
2.  Search for Azure Storage Accounts and select the storage account you want to check.
    
3.  In the left-hand menu, under Data Management, select Data protection.
    
4.  Check whether Soft Delete for blobs is enabled or disabled.
    
5.  If it is disabled, follow the implementation steps
    

  

Implementation Steps:

1.  Log in to the Azure Portal.
    
2.  Search for Azure Storage Accounts and select the storage account you want to check.
    
3.  In the left-hand menu, under Data Management, select Data protection.
    

4.  Enable Soft Delete for blobs and specify the retention period in days (default is 7 days, maximum is 365 days).
    

5.  Save it.
    

  

Backout Plan:

1.  Log in to the Azure Portal.
    
2.  Search for Azure Storage Accounts and select the storage account you want to check.
    
3.  In the left-hand menu, under Data Management, select Data protection.
    
4.  Uncheck the “Enable soft delete for blobs”.
    

References:

-   [https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview](https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview)
    
-   [https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal](https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.