Defender for Storage malware scanning catches infected files at upload

Azure Blob Storage makes a convenient backend for customer portals and intake apps, right up until an infected file gets through. In a lot of the cloud environments I work in, uploads get far too much trust. Files go straight into storage, and an app or a scheduled script checks them later, if anything checks them at all. Defender for Storage malware scanning in Microsoft Defender for Cloud deals with this risk at the point of upload, inside the storage account itself. No custom anti-malware VMs, no fragile home-grown scripts.

Malware scanning is enabled in the Defender plans settings for Storage

The setting lives in Microsoft Defender for Cloud → Environment settings → your subscription → Defender plans → Storage → Settings. You can enforce scanning for all accounts there, or configure overrides per account. Defender for Storage malware scanning plugs into the Event Grid pipeline and checks newly uploaded blobs in near real-time. What I like most is that the scan results get written back to each blob as index tags, so you can always see whether a file was scanned, when, and with what outcome.

You need at least Defender for Storage Plan 2 to use the feature. To keep costs predictable, you can also cap the number of scans per storage account each month. That matters a lot for large customer portals where upload volumes are hard to forecast.

Scan results land as blob tags and Event Grid handles the quarantine

Once a scan finishes, the results show up as custom tags on the blob. The tag names and values (such as 'MalwareScanStatus' and 'MalwareScanResult') are documented in the official Microsoft documentation. That gives you something to automate against: Event Grid can kick off workflows that move suspicious files into quarantine or notify your security team.

My usual tool for these events is a Logic App. When a blob turns up tagged "MalwareScanResult=Malicious", the Logic App either moves it to a quarantine container or deletes it. Here is the pipeline in diagram form:

flowchart LR
    Upload["Blob upload"] --> Scan["Malware scan (Defender)"]
    Scan --> Tag["Scan status as blob tag"]
    Tag --> EventGrid["Event Grid trigger"]
    EventGrid --> Action["Quarantine workflow"]

Figure: Automated quarantine using Defender for Storage malware scanning and Event Grid.

Keep in mind that the quarantine process is yours to design, for example moving files to a private container with locked-down access. Defender for Storage detects and signals, nothing more. What happens after that is up to your workflows.

A monthly scan cap per storage account keeps costs under control

In busy environments the scan cap is the setting I pay most attention to. You set a limit per account in the Defender portal so the bill doesn't surprise you. Be aware that once the cap is reached, new files are no longer scanned automatically. App owners need to know this, and you need monitoring in place. I normally track the remaining quota in Azure Monitor and have it alert me before scanning stops.

Practical tip: Don’t switch scanning on everywhere by default. Start by finding out where uploads come from external users or automated sources, and point Defender for Storage malware scanning (along with an automation workflow) at those accounts first.

Plan 2 also raises alerts for threats involving sensitive data

Defender for Storage Plan 2 goes beyond malware scanning and includes threat detection for sensitive data. If files with credit card numbers or other confidential details show up in a suspicious context, Defender can raise an alert. For customer portals with compliance requirements, that is very useful. The Defender for Storage overview covers this in more detail.

Getting this into Sentinel or another SIEM is not hard. Alerts for malware or sensitive data hits can flow straight into your incident response process, usually through a Logic App or a chain from Event Grid to Function App to Log Analytics.

Upload scanning has become basic hygiene in my view

As far as I'm concerned, Defender for Storage malware scanning is the first practical, cloud-native way to reliably protect uploads to Azure Blob Storage. You don't have to wrestle with integrating an AV engine or buy a third-party add-on. Scan tags, Event Grid automation and per-account cost control together fit how real operations teams work. If you still depend on deferred scanning or people checking files by hand, it's time to move on. Once it's in place, your malware risk drops sharply and compliance gets easier, particularly where customer data or sensitive business data is involved. The setup effort pays for itself quickly, and I wouldn't run an externally facing upload pipeline in Azure without it.