Control: 4.1.3 Ensure that 'Auditing' Retention is 'greater than 90 days'


It is recommended SQL Server Audit Retention should be configured to be greater than 90 days. Audit Logs can be used to check for anomalies and give insight into suspected breaches or misuse of information and access.

Default setting for SQL Server audit storage is disabled.


From Console

  1. Login to Azure console and navigate to SQL Servers.
  2. For each server instance, go to Security section from left pane.
  3. Click on Auditing.
  4. Set Enable Azure SQL Auditing to On and select a storage account for log destination.
  5. Set Retention Days setting to greater than 90 days.
  6. Click Save.

From PowerShell

set-AzureRmSqlServerAuditing -ResourceGroupName <resource group name> - ServerName <server name> -RetentionInDays <Number of Days to retain the audit logs, should be 90days minimum>


steampipe check azure_compliance.control.cis_v130_4_1_3


This control uses a named query: