Enable soft delete for blobs

Is this page helpful?

Any additional feedback?

Feedback will be sent to Microsoft: By pressing the submit button, your feedback will be used to improve Microsoft products and services. Privacy policy.

Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time. During the retention period, you can restore the blob to its state at deletion. After the retention period has expired, the blob is permanently deleted. For more information about blob soft delete, see Soft delete for blobs.

Blob soft delete is part of a comprehensive data protection strategy for blob data. To learn more about Microsoft's recommendations for data protection, see Data protection overview.

Blob soft delete is enabled by default for a new storage account. You can enable or disable soft delete for a storage account at any time by using the Azure portal, PowerShell, or Azure CLI.

Enable blob soft delete

Portal

To enable blob soft delete for your storage account by using the Azure portal, follow these steps:

1. In the Azure portal, navigate to your storage account.
2. Locate the Data Protection option under Data management.
3. In the Recovery section, select Turn on soft delete for blobs.
4. Specify a retention period between 1 and 365 days. Microsoft recommends a minimum retention period of seven days.
5. Save your changes.

PowerShell

To enable blob soft delete with PowerShell, call the Enable-AzStorageBlobDeleteRetentionPolicy command, specifying the retention period in days.

The following example enables blob soft delete and sets the retention period to seven days. Remember to replace the placeholder values in brackets with your own values:

Enable-AzStorageBlobDeleteRetentionPolicy -ResourceGroupName <resource-group> `
    -StorageAccountName <storage-account> `
    -RetentionDays 7

To check the current settings for blob soft delete, call the Get-AzStorageBlobServiceProperty command:

$properties = Get-AzStorageBlobServiceProperty -ResourceGroupName <resource-group> `
    -StorageAccountName <storage-account>
$properties.DeleteRetentionPolicy.Enabled
$properties.DeleteRetentionPolicy.Days

Azure CLI

To enable blob soft delete with Azure CLI, call the az storage account blob-service-properties update command, specifying the retention period in days.

The following example enables blob soft delete and sets the retention period to seven days. Remember to replace the placeholder values in brackets with your own values:

az storage account blob-service-properties update --account-name <storage-account> \
    --resource-group <resource-group> \
    --enable-delete-retention true \
    --delete-retention-days 7

To check the current settings for blob soft delete, call the az storage account blob-service-properties show command:

az storage account blob-service-properties show --account-name <storage-account> \
    --resource-group <resource-group>

Enable blob soft delete (hierarchical namespace)

Blob soft delete can also protect blobs and directories in accounts that have the hierarchical namespace feature enabled on them.

Portal

To enable blob soft delete for your storage account by using the Azure portal, follow these steps:

1. In the Azure portal, navigate to your storage account.
2. Locate the Data Protection option under Data Management.
3. In the Recovery section, select Enable soft delete for blobs.
4. Specify a retention period between 1 and 365 days. Microsoft recommends a minimum retention period of seven days.
5. Save your changes.

PowerShell

1. Install the latest PowershellGet module. Then, close and reopen the PowerShell console.

   install-Module PowerShellGet -Repository PSGallery -Force
   

2. Install Az.Storage preview module.

   Install-Module Az.Storage -Repository PsGallery -RequiredVersion 3.7.1-preview -AllowClobber -AllowPrerelease -Force
   

   For more information about how to install PowerShell modules, see Install the Azure PowerShell module

3. Obtain storage account authorization by using either a storage account key, a connection string, or Azure Active Directory (Azure AD). For more information, see Connect to the account.

   The following example obtains authorization by using a storage account key.

   $ctx = New-AzStorageContext -StorageAccountName '<storage-account-name>' -StorageAccountKey '<storage-account-key>'
   

4. To enable blob soft delete with PowerShell, use the Enable-AzStorageDeleteRetentionPolicy command, and specify the retention period in days.

   The following example enables soft delete for an account, and sets the retention period to 4 days.

   Enable-AzStorageDeleteRetentionPolicy -RetentionDays 4  -Context $ctx
   

5. To check the current settings for blob soft delete, use the Get-AzStorageServiceProperty command:

    Get-AzStorageServiceProperty -ServiceType Blob -Context $ctx
   

Azure CLI

1. Open the Azure Cloud Shell, or if you've installed the Azure CLI locally, open a command console application such as Windows PowerShell.

2. Install the storage-preview extension.

   az extension add -n storage-preview
   

3. Connect to your storage account. For more information, see Connect to the account.

   Note

   The example presented in this article show Azure Active Directory (Azure AD) authorization. To learn more about authorization methods, see Authorize access to blob or queue data with Azure CLI.

4. To enable soft delete with Azure CLI, call the az storage fs service-properties update command, specifying the retention period in days.

   The following example enables blob and directory soft delete and sets the retention period to 5 days.

   az storage fs service-properties update --delete-retention --delete-retention-period 5 --auth-mode login
   

5. To check the current settings for blob soft delete, call the az storage fs service-properties update command:

   az storage fs service-properties update --delete-retention false --connection-string $con
   

Next steps

• Soft delete for blobs
• Manage and restore soft-deleted blobs