Storage blobs are getting deleted in azure storage account from one specific container. What could be the reason?

Hi Dharma Teja Mukka,

Thanks for update. Since there are no Lifecycle Management rules and you're not seeing delete logs, here's how to find out who deleted your blobs and how to stop it from happening again.

Enable diagnostic logging (this is the most important step)

By default, Azure doesn't record all blob operations. You need to turn on logging manually:

• Go to your Storage Account in the Azure Portal
• Click Monitoring → Diagnostic settings
• Add a new diagnostic setting
• Check these boxes:
  • StorageRead
  • StorageWrite
  • StorageDelete
  • StorageBlobLogs
• Send logs to a Log Analytics Workspace (best option) or to your storage account

Once this is on, all future blob operations will be logged with who did what.

Check the logs for delete operations

If you have Log Analytics, run this query:

StorageBlobLogs
| where OperationName == "DeleteBlob"
| sort by TimeGenerated desc

Look at these columns:

• RequesterUpn – The email of the person or app that deleted it
• CallerIpAddress – The IP address
• TimeGenerated – When it happened

Important: If someone used a SAS token or account key instead of signing in with their Microsoft account, the logs won't show their name.

Check Azure Activity Log

• Go to Storage Account → Activity Log
• Filter for Delete operations
• This shows who deleted containers or changed storage settings

Check for automated tools

Look for these that might be deleting blobs automatically:

• Azure Data Factory pipelines
• Logic Apps workflows
• Azure Functions
• Backup software
• Custom scripts running on VMs
• CI/CD pipelines from Azure DevOps or GitHub

Why You're Not Seeing Logs

If deletions happened but you don't see logs:

1. Logging was not turned on before the deletions (logs don't work for past events)
2. Someone used a SAS token or account key (these don't show the user's name)
3. Logs are in a place you haven't checked yet (like the $logs container inside your storage account)

How to Prevent Future Deletions

Turn on diagnostic logging

This is essential. Without it, you won't know who deleted anything.

Turn on Blob Versioning

This keeps old versions of blobs even after deletion:

• Go to Storage Account → Data composition → Blob versioning
• Turn it on

Increase Soft Delete retention

You have 7 days now. Change it to 30 days to give yourself more time to recover:

• Go to Storage Account → Data protection → Blob soft delete
• Change retention from 7 to 30 days

Use Immutable Storage for important data

This prevents any deletion for a set time:

• Go to Data protection → Immutable blob storage
• Turn on Time-based retention or Legal hold

Check who has permission to delete

• Go to Storage Account → Access control (IAM)
• Remove Storage Blob Data Contributor access from people who don't need it
• Use Storage Blob Data Reader for people who only need to view files

Set up alerts for deletions

Create an alert so you get notified when blobs are deleted:

• Go to Alerts → New alert rule
• Select your storage account
• Set condition to trigger on DeleteBlob operations
• Set up email or Teams notification

Follow the below steps:

1. Turn on diagnostic logging right away
2. Change soft delete from 7 days to 30 days
3. Turn on blob versioning
4. Check who has permission to delete and remove unnecessary access
5. Look for any automation tools (Data Factory, Logic Apps, scripts) that might delete blobs
6. Set up alerts for delete operations

Once logging is on, you'll be able to see exactly who deleted blobs, from what IP address, and when. This will help you find the root cause and stop it from happening again.

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Hello Dharma Teja Mukka

Greetings! Thanks for raising this question in Q&A forum.

Blobs getting deleted from one specific container is definitely a serious concern and worth investigating immediately. The fact that it is happening in only one specific container is actually a helpful clue it points toward something configured or triggered specifically for that container rather than a broader account-level issue. Here are all the possible causes and how to investigate each one.

Step 1: Check the Activity Log and Storage Diagnostic Logs first This is the most important starting point. Go to the Azure Portal > your Storage Account > Monitoring > Activity Log. Filter by the time range when deletions occurred and look for any Delete Blob or Delete Container operations. Also enable and check Storage Analytics Logs or Azure Monitor diagnostic logs for the storage account these capture every read, write, and delete operation with the caller's IP, identity, and timestamp.

To enable diagnostic logging if not already on:

1. Go to your Storage Account > Monitoring > Diagnostic Settings
2. Add a diagnostic setting, select "StorageWrite", "StorageDelete", and send to a Log Analytics workspace
3. Then run a Kusto query like:

StorageBlobLogs
| where OperationName == "DeleteBlob"
| where TimeGenerated > ago(7d)
| project TimeGenerated, CallerIpAddress, AuthenticationType, Uri, StatusCode

This will tell you exactly who or what is deleting the blobs and from where.

Step 2: Check if a Lifecycle Management Policy is configured This is the most common cause of automatic blob deletions from a specific container. Go to your Storage Account > Data Management > Lifecycle Management. Check if there is any rule that targets your specific container by name or prefix, and has a Delete action configured after a certain number of days. If a rule exists with a low day threshold, it will silently delete blobs matching the criteria.

Step 3: Check for an expiry or retention policy on the container Go to your Storage Account > Containers > select the affected container > Access Policy. Check if there is an immutability policy or a time-based retention policy configured paradoxically, when a retention policy expires on specific blobs, they can become eligible for deletion by lifecycle rules or application code.

Step 4: Check for any Azure Function, Logic App, or automation job targeting this container Search your Azure subscription for any Function Apps, Logic Apps, Data Factory pipelines, or Automation Runbooks that reference this specific storage account and container. It is common for automated processes to clean up blobs for example, an event-triggered Function that deletes processed files, or a scheduled Logic App that purges old data.

Step 5: Review who has access to this specific container Go to your Storage Account > Access Control (IAM) and look for identities with "Storage Blob Data Contributor" or "Storage Blob Data Owner" roles. Also check the container-level Shared Access Signature (SAS) tokens if a SAS with delete permissions was shared, it could be used by an external process or even misused.

Also check: Storage Account > Networking to see if the container is publicly accessible, and review if any SAS tokens with delete permissions are still active.

Step 6: Check for Event Grid or Blob triggers Go to your Storage Account > Events and check if any Event Grid subscriptions are listening to blob events (like BlobCreated) and triggering a downstream service that might be processing and then deleting the blobs as part of a workflow.

Step 7: Enable Soft Delete immediately to protect against further loss Even while investigating, enable Soft Delete right now so that any further deleted blobs are recoverable. Go to your Storage Account > Data Management > Data Protection > enable "Enable soft delete for blobs" and set a retention period (7–30 days). This will not recover already-deleted blobs, but it will protect you from further irreversible losses while you identify the root cause.

Step 8: Recover already-deleted blobs if soft delete was previously enabled If soft delete was already enabled before the deletions occurred, the blobs may still be recoverable. Go to your container in the portal, click the "Show deleted blobs" option in the filter, select the deleted blobs, and click Undelete.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.