# Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts

- Source: https://support.icompaas.com/support/solutions/articles/62000234814-ensure-versioning-is-set-to-enabled-on-azure-blob-storage-storage-accounts
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

-   **Level 2**
    

### Description:

Enabling blob versioning allows Azure to retain previous versions of blobs automatically. When versioning is enabled, every write operation to a blob results in the creation of a new version. These versions can be restored if the current blob is deleted or overwritten.

### Rationale:

Blob versioning supports data integrity and recoverability. It protects against accidental deletion, unintended overwrites, or malicious tampering by maintaining a history of changes.

### Impact:

-   Enabling versioning increases storage consumption and may raise storage costs.
    
-   Organizations can mitigate this by applying lifecycle management policies to automatically delete older blob versions.
    

### Default Value:

Blob versioning is disabled by default on Azure storage account.

### Pre-Requisites:

-   The storage account must be a General-purpose v2 (StorageV2) account.
    

### Test Plan:

#### Using Azure Console:

1.  Navigate to Storage accounts in the Azure Portal.
    
2.  Select a storage account with Blob storage enabled.  
    
3.  Under Settings, click Data protection.  
    
4.  Confirm that Enable versioning for blobs is checked.
    

#### Using Azure CLI:

Run:

az storage account blob-service-properties show --account-name <storage-account>

Ensure the output includes:

"isVersioningEnabled": true

#### Using PowerShell:

Create a context:

$context = New-AzStorageContext -StorageAccountName <storage-account>

Check versioning:

$account = Get-AzStorageBlobServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account>
$account.IsVersioningEnabled

### Implementation Plan

#### Using Azure Console:

1.  Go to Storage accounts.  
    
2.  Click on a storage account.  
    
3.  Select Data protection under Settings.  
    
4.  Check Enable versioning for blobs.  
    
5.  Choose to either:  
    
    -   Keep all versions, or  
        
    -   Delete versions after a specified number of days.  
        
6.  Click Save.
    

#### Using Azure CLI:

Run:

az storage account blob-service-properties update --account-name <storage-account> --enable-versioning true

#### Using PowerShell:

Run:

Update-AzStorageBlobServiceProperty -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -IsVersioningEnabled $true

### Backout Plan

#### Using Azure Console:

1.  Go to Storage accounts.  
    
2.  Open the relevant storage account.  
    
3.  Navigate to Data protection.  
    
4.  Uncheck Enable versioning for blobs.  
    
5.  Click Save.
    

#### Using Azure CLI:

Run:

az storage account blob-service-properties update --account-name <storage-account> --enable-versioning false

#### Using PowerShell:

Update-AzStorageBlobServiceProperty -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -IsVersioningEnabled $false

### References:

-   [Blob Versioning Overview](https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-overview)
    
-   [Azure CLI: blob-service-properties](https://learn.microsoft.com/en-us/cli/azure/storage/account/blob-service-properties)
    
-   [PowerShell: Update-AzStorageBlobServiceProperty](https://learn.microsoft.com/en-us/powershell/module/az.storage/update-azstorageblobserviceproperty)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.