Storage Account with Storage Service Encryption and a blob deletion retention policy
{"type": "microsoft.storage/storageaccounts", "name": "[variables('storageaccountdiagnostics')]", "apiversion": "2021-02-01", "location": "[parameters('location')]", "sku": {"name": "standard_lrs"}}{"type": "microsoft.storage/storageaccounts", "name": "[variables('storageaccountvms')]", "apiversion": "2021-02-01", "location": "[parameters('location')]", "sku": {"name": "premium_lrs"}} 