--- title: "Azure Appendix B: Deletion Security" slug: "azure-appendix-b-deletion-security" tags: ["Azure", "Best Practices"] updated: 2026-07-24T14:57:11Z published: 2026-07-24T14:57:11Z canonical: "docs.nasuni.com/azure-appendix-b-deletion-security" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.nasuni.com/llms.txt > Use this file to discover all available pages before exploring further. # Azure Appendix B: Deletion Security The Microsoft Azure cloud storage platform offers a number of safeguards to prevent, or mitigate, unwanted deletion. You might choose to employ some or all of these safeguards. For details, see [Security recommendations for Blob storage.](https://docs.microsoft.com/en-us/azure/storage/blobs/security-recommendations) ### Choose an Azure Storage Redundancy Option You should carefully consider the best redundancy options for your data and your organization. Considerations might include legally mandated locations for data, as well as geographic proximity to other resources. [Toward this end, Microsoft offers locally redundant storage (LRS), zone-redundant storage (ZRS), georedundant storage (GRS), and geo-zone-redundant storage (preview) (GZRS). For details, see A](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources)[zure Storage redundancy](https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy). ### Use Azure Resource Locks to Prevent Deletion You can lock a subscription, a resource group, or a resource to prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to CanNotDelete or ReadOnly. - CanNotDelete: Authorized users can still read and modify a resource, but they cannot delete the resource. In the portal, this lock is called Delete. - ReadOnly: Authorized users can read a resource, but they cannot modify or delete. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role. In the portal, this lock is called Read-only. A resource inherits any lock from its parent. To create or delete management locks, you must have access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions. Of the built-in roles, only the Owner role and the User Access Administrator role are granted those actions. For more information, see [Lock resources to prevent unexpected changes](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources). ### Restrict Container Delete Permissions with a Shared Access Signature [You can use a shared access signature (SAS) to ensure that other users do not have the ability to delete items.](https://docs.microsoft.com/bs-latn-ba/azure/virtual-machines/troubleshooting/storage-resource-deletion-errors) The purpose of the shared access signature is to allow users besides yourself to access resources in your storage account, but only with the permissions that you specify. For example, you can allow other users to read and write, but not delete. Only the account owner can create the shared access signature (SAS). Using this practice, no one but the account owner can delete one of your containers. For more information, see [Prevent Container Delete Access](https://social.msdn.microsoft.com/Forums/azure/en-US/ced7bbb4-54b1-484e-989e-538da16c1fbe/prevent-container-delete-access). > [!TIP] > *Tip: Soft delete for containers is also available. For details, see https://docs.microsoft.com/enus/azure/storage/blobs/soft-delete-container-overview.* ### Protect Attached Disks and Leased Blobs from Deletion Azure prevents the deletion of a disk that is attached to a VM. It also prevents deletion of containers and storage accounts that have a page blob that is attached to a VM. In addition, leased blobs cannot be deleted without breaking the lease first. Leased blobs that are not attached to a VM prevent deletion of the blob, but do not prevent deletion of the container or storage account. You can use these features to protect disks, containers, storage accounts, and blobs from unwanted deletion. For more information, see [Troubleshoot storage resource deletion errors](https://docs.microsoft.com/bs-latn-ba/azure/virtual-machines/troubleshooting/storage-resource-deletion-errors). ### Enable Soft Delete to Recover Deleted Blob Data When enabled, soft delete enables you to recover your data when blobs or blob snapshots are deleted. This protection extends to blob data that is erased as the result of an overwrite. When data is deleted, it transitions to a soft deleted state instead of being permanently erased. When soft delete is on and you overwrite data, a soft deleted snapshot is generated to save the state of the overwritten data. You can configure the amount of time soft deleted data is recoverable before it is permanently expired. Soft delete is off by default. Nasuni recommends enabling soft delete with a retention period of 30 days. Soft delete does not save your data in cases of container or account deletes. “Soft Delete” helps recover deleted data For more information, see [Soft delete for blobs](https://docs.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview).