How do I install the Cis Azure Foundations 9.2.2 skill?

Run npx skillmds@latest add cyberstrikeus/cis-azure-foundations-9-2-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Azure Foundations 9.2.2 skill do?

Ensure soft delete for containers on Azure Blob Storage storage accounts is Enabled It is listed under DevOps & Infra on SkillMD.

Is Cis Azure Foundations 9.2.2 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Azure Foundations 9.2.2?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Azure Foundations 9.2.2 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Azure Foundations 9.2.2?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Azure Foundations 9.2.2 by cyberstrikeus

Name: Cis Azure Foundations 9.2.2
Author: cyberstrikeus

File contents

Ensure soft delete for containers on Azure Blob Storage storage accounts is Enabled

Description

Containers in Azure storage accounts may contain sensitive or personal data, such as ePHI or financial information. Data that is erroneously modified or deleted by an application or a user can lead to data loss or unavailability.

It is recommended that soft delete for containers be enabled on Azure storage accounts with blob storage to allow for the preservation and recovery of data when containers are deleted.

Rationale

Containers can be deleted incorrectly. An attacker or malicious user may do this deliberately in order to cause disruption. Deleting a container results in immediate data loss. Enabling this configuration for Azure storage accounts ensures that even if containers are deleted from the storage account, the containers are recoverable for a specific period of time, which is defined in the "Retention policies," ranging from 7 to 365 days.

Impact

All soft-deleted data is billed at the same rate as active data. Additional costs may be incurred for deleted containers until the soft delete period ends and the data is permanently removed.

Audit Procedure

Audit from Azure Portal

Go to Storage accounts.
For each Storage Account with blob storage, under Data management, go to Data protection.
Ensure that Enable soft delete for containers is checked.
Ensure that the retention period is a sufficient length for your organization.

Audit from Azure CLI

Run the following command to list storage accounts:

az storage account list

Run the following command to determine if a storage account has containers:

az storage container list --account-name <storage-account>

For each storage account with containers, run the following command to get the retention settings:

az storage account blob-service-properties show --resource-group <resource-group> --account-name <storage-account> --query containerDeleteRetentionPolicy

Ensure that enabled is set to true and days is not null.

Expected Result

Container soft delete should be enabled with enabled set to true and days set to an appropriate retention period.

Remediation

Remediate from Azure Portal

Go to Storage accounts.
For each Storage Account with blob storage, under Data management, go to Data protection.
Check the box next to Enable soft delete for containers.
Set the retention period to a sufficient length for your organization.
Click Save.

Remediate from Azure CLI

Run the following command to update container retention:

az storage account blob-service-properties update --resource-group <resource-group> --account-name <storage-account> --enable-container-delete-retention true --container-delete-retention-days <retention-days>

Default Value

Soft delete for containers is enabled by default on storage accounts created via the Azure Portal, and disabled by default on storage accounts created via Azure CLI or PowerShell.

References

Profile

Level 1

---name: cis-azure-foundations-9-2-2description: Ensure soft delete for containers on Azure Blob Storage storage accounts is Enabled---# Ensure soft delete for containers on Azure Blob Storage storage accounts is Enabled## DescriptionContainers in Azure storage accounts may contain sensitive or personal data, such as ePHI or financial information. Data that is erroneously modified or deleted by an application or a user can lead to data loss or unavailability.It is recommended that soft delete for containers be enabled on Azure storage accounts with blob storage to allow for the preservation and recovery of data when containers are deleted.## RationaleContainers can be deleted incorrectly. An attacker or malicious user may do this deliberately in order to cause disruption. Deleting a container results in immediate data loss. Enabling this configuration for Azure storage accounts ensures that even if containers are deleted from the storage account, the containers are recoverable for a specific period of time, which is defined in the "Retention policies," ranging from 7 to 365 days.## ImpactAll soft-deleted data is billed at the same rate as active data. Additional costs may be incurred for deleted containers until the soft delete period ends and the data is permanently removed.## Audit Procedure### Audit from Azure Portal1. Go to `Storage accounts`.2. For each Storage Account with blob storage, under `Data management`, go to `Data protection`.3. Ensure that `Enable soft delete for containers` is checked.4. Ensure that the retention period is a sufficient length for your organization.### Audit from Azure CLIRun the following command to list storage accounts:```bashaz storage account list```Run the following command to determine if a storage account has containers:```bashaz storage container list --account-name <storage-account>```For each storage account with containers, run the following command to get the retention settings:```bashaz storage account blob-service-properties show --resource-group <resource-group> --account-name <storage-account> --query containerDeleteRetentionPolicy```Ensure that `enabled` is set to `true` and `days` is not `null`.## Expected ResultContainer soft delete should be enabled with `enabled` set to `true` and `days` set to an appropriate retention period.## Remediation### Remediate from Azure Portal1. Go to `Storage accounts`.2. For each Storage Account with blob storage, under `Data management`, go to `Data protection`.3. Check the box next to `Enable soft delete for containers`.4. Set the retention period to a sufficient length for your organization.5. Click `Save`.### Remediate from Azure CLIRun the following command to update container retention:```bashaz storage account blob-service-properties update --resource-group <resource-group> --account-name <storage-account> --enable-container-delete-retention true --container-delete-retention-days <retention-days>```## Default ValueSoft delete for containers is **enabled** by default on storage accounts created via the Azure Portal, and **disabled** by default on storage accounts created via Azure CLI or PowerShell.## References1. https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-container-overview2. https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-container-enable## ProfileLevel 1

Frequently asked questions

Cis Azure Foundations 9.2.2