# Ensure Storage Logging Is Enabled for Queue Service for 'Read', 'Write', and 'Delete' Requests

- Source: https://support.icompaas.com/support/solutions/articles/62000234867-ensure-storage-logging-is-enabled-for-queue-service-for-read-write-and-delete-requests
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Description:

Storage Logging for Azure Queue service captures detailed information about all requests made to the queue endpoint, including read, write, and delete operations. When enabled, it records essential metadata such as timestamps, operation types, requester identity, IP address, and response status. This provides valuable visibility into how queue storage is accessed and used, supporting monitoring, troubleshooting, auditing, and operational analysis.

### Rationale:

Enabling Storage Logging ensures that all interactions with the Azure Queue service are fully traceable. This is critical for:

-   Identifying unauthorized or anomalous activity
    
-   Supporting forensic investigations by providing historical operation data
    
-   Meeting compliance and governance requirements that mandate detailed access and modification logs
    
-   Maintaining strong operational oversight of message processing workflows
    

### Impact:

-   Improves visibility into all queue service operations (read, write, delete)
    
-   Strengthens security monitoring and supports detailed audit trails
    
-   Facilitates troubleshooting and performance analysis for message processing issues
    
-   Generates additional log data, increasing storage consumption and associated cost
    
-   Requires ongoing management of retention and lifecycle policies for log data
    

### Default Value:

Storage Logging for the Azure Queue service is disabled by default.

#### Pre-requisites:

-   Global Administrator or Security Administrator permissions 
    
-   Storage Account Must Support Queue Service Logging
    

Test Plan:

1.  Sign in to the Azure Portal.
    
2.  Search for Azure Storage Accounts and select the specific storage account.
    
3.  In the left-hand menu, under Monitoring, select Diagnostic settings.
    
4.  Confirm that logging is enabled for the Queue service, with Read, Write, and Delete operations selected.
    

![](https://support.icompaas.com/assets/kb/73e2b655ceca3973.png)

5.  If it is disabled, follow the Implementation Steps.
    

Implementation Steps:

1.  Sign in to the Azure Portal.
    
2.  Search for Azure Storage Accounts and select the specific storage account.
    
3.  Under the Monitoring section, select Diagnostic settings and click on Queue services.
    

![](https://support.icompaas.com/assets/kb/b24378991e507f3b.png)

4.  Click Add diagnostic setting.
    

![](https://support.icompaas.com/assets/kb/455a3c7d3c6d2d69.png)

5.  In the diagnostic setting, provide a name, select all logs (Read, Write, and Delete), and choose the destination storage account to send the logs. And click save.
    

![](https://support.icompaas.com/assets/kb/3c932504f846b3e4.png)

6.  The diagnostic setting will be created.
    

![](https://support.icompaas.com/assets/kb/7e08f94e31c8a068.png)

Backout plan:

1.  Sign in to the Azure Portal.
    
2.  Search for Azure Storage Accounts and select the specific storage account.
    
3.  Under Monitoring, select Diagnostic settings. Click Edit settings.
    
4.  Click on delete.
    

Reference:

-   [https://learn.microsoft.com/en-us/azure/storage/common/storage-analytics-logging](https://learn.microsoft.com/en-us/azure/storage/common/storage-analytics-logging)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.