A compliance auditor asks Cascade Regional Airlines to prove that safety-incident report blobs cannot be modified or deleted, even accidentally by an administrator with full account access, for a mandatory five-year retention period? Which blob storage feature enforces this?

Immutable blob storage with a time-based retention policy enforces write-once-read-many, or WORM, behavior at the storage-service level: once a policy is locked, the blobs it covers cannot be modified or deleted by any identity, including the storage account owner, until the retention interval elapses, which directly satisfies a mandatory five-year, tamper-proof retention requirement. Soft delete is a recovery mechanism, not a prevention mechanism — it still allows delete and overwrite operations to succeed, simply preserving a recoverable version for the configured window, so a determined or compromised administrator could still trigger changes that must later be manually reverted. Blob versioning likewise permits ongoing overwrites and captures prior versions as a history, but nothing stops the current version from being altered, and without a retention policy old versions themselves are not protected from purge. A storage account firewall rule controls network-level access to the account by source IP or virtual network, which is an access-control measure, not a content-immutability guarantee, and an authorized administrator inside the allowed network could still delete data. A concrete operational check: attempt a delete operation against a locked immutable blob from an account-owner identity in a test container and confirm the service returns an authorization failure specifically due to the retention policy.