The Microsoft Azure cloud storage platform offers a number of safeguards to prevent, or mitigate, unwanted deletion. You might choose to employ some or all of these safeguards. For details, see Security recommendations for Blob storage.
Storage redundancy
You should carefully consider the best redundancy options for your data and your organization. Considerations might include legally mandated locations for data, as well as geographic proximity to other resources.
Toward this end, Microsoft offers locally redundant storage (LRS), zone-redundant storage (ZRS), georedundant storage (GRS), and geo-zone-redundant storage (preview) (GZRS). For details, see Azure Storage redundancy.
Locking resources
You can lock a subscription, a resource group, or a resource to prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to CanNotDelete or ReadOnly.
CanNotDelete: Authorized users can still read and modify a resource, but they cannot delete the resource.
In the portal, this lock is called Delete.
ReadOnly: Authorized users can read a resource, but they cannot modify or delete. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.
In the portal, this lock is called Read-only.
A resource inherits any lock from its parent.
To create or delete management locks, you must have access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions. Of the built-in roles, only the Owner role and the User Access Administrator role are granted those actions.
For more information, see Lock resources to prevent unexpected changes.
Preventing container delete access
The purpose of the shared access signature is to allow users besides yourself to access resources in your storage account, but only with the permissions that you specify. For example, you can allow other users to read and write, but not delete.
Only the account owner can create the shared access signature (SAS).
Using this practice, no one but the account owner can delete one of your containers.
For more information, see Prevent Container Delete Access.
Tip: Soft delete for containers is also available. For details, see https://docs.microsoft.com/enus/azure/storage/blobs/soft-delete-container-overview.
Attaching to a VM
Azure prevents the deletion of a disk that is attached to a VM. It also prevents deletion of containers and storage accounts that have a page blob that is attached to a VM.
In addition, leased blobs cannot be deleted without breaking the lease first. Leased blobs that are not attached to a VM prevent deletion of the blob, but do not prevent deletion of the container or storage account.
You can use these features to protect disks, containers, storage accounts, and blobs from unwanted deletion.
For more information, see Troubleshoot storage resource deletion errors.
“Soft Delete” helps recover deleted data
When enabled, soft delete enables you to recover your data when blobs or blob snapshots are deleted. This protection extends to blob data that is erased as the result of an overwrite.
When data is deleted, it transitions to a soft deleted state instead of being permanently erased.
When soft delete is on and you overwrite data, a soft deleted snapshot is generated to save the state of the overwritten data.
You can configure the amount of time soft deleted data is recoverable before it is permanently expired.
Soft delete is off by default. Nasuni recommends enabling soft delete with a retention period of 30 days.
Soft delete does not save your data in cases of container or account deletes.
“Soft Delete” helps recover deleted data
For more information, see Soft delete for blobs.