AZ-015 Microsoft Azure

Storage blob soft delete is enabled.

Storage blob soft delete is enabled.

Domain
Microsoft Azure
Area
Storage
Automated / manual
Automated

Risk if it fails

Accidental/malicious deletion is unrecoverable.

Ransomware and disgruntled insiders delete data. Soft delete keeps a recoverable copy so a malicious wipe does not become permanent loss.

How Tess tests it

1 test — each concludes only on cited evidence.

Storage blob soft delete is enabled.

Automated
Procedure
Confirm blob soft-delete retention policy is enabled.

Read-only command 

az storage account blob-service-properties show --account-name <name> --query 'deleteRetentionPolicy'

More in Microsoft Azure

AZ-001 MFA is enforced for all users, especially privileged roles. AZ-002 Number of Global Administrators is limited (typically 2-4). AZ-003 Privileged Identity Management (PIM) provides just-in-time elevation. AZ-004 Legacy/basic authentication is blocked.

Want Tess to test AZ-015 against your evidence?

Book a demo