Protect your Azure storage accounts using Microsoft Defender for Cloud - Azure Storage (2024)

We recommend that you enable Defender for Storage on the subscription level. Doing so ensures all storage accounts in the subscription will be protected, including future ones.

There are several ways to enable Defender for Storage on subscriptions:

• Azure portal
• Azure built-in policy
• IaC templates, including Bicep and ARM
• REST API

Azure portal

To enable Defender for Storage at the subscription level using the Azure portal:

1. Sign in to the Azure portal.

2. Navigate to Microsoft Defender for Cloud > Environment settings.

3. Select the subscription for which you want to enable Defender for Storage.

4. On the Defender plans page, locate Storage in the list and select On and Save.

   If you currently have Defender for Storage enabled with per-transaction pricing, select the New pricing plan available link and confirm the pricing change.

Microsoft Defender for Storage is now enabled for this subscription, and is fully protected, including on-upload malware scanning and sensitive data threat detection.

If you want to turn off the On-upload malware scanning or Sensitive data threat detection, you can select Settings and change the status of the relevant feature to Off.

If you want to change the malware scanning size cap per storage account per month for malware, change the settings in Edit configuration.

If you want to disable the plan, toggle the status button to Off for the Storage plan on the Defender plans page.

Enable and configure at scale with an Azure built-in policy

To enable and configure Defender for Storage at scale with an Azure built-in policy to ensure that consistent security policies are applied across all existing and new storage accounts within the subscriptions, follow these steps:

1. Sign in to the Azure portal and navigate to the Policy dashboard.
2. In the Policy dashboard, select Definitions from the left-side menu.
3. In the “Security Center” category, search for and then select the Configure Microsoft Defender for Storage to be enabled. This policy will enable all Defender for Storage capabilities: Activity Monitoring, Malware Scanning and Sensitive Data Threat Detection. You can also get it here: List of built-in policy definitionsIf you want to enable a policy without the configurable features, use Configure basic Microsoft Defender for Storage to be enabled (Activity Monitoring only).
4. Choose the policy and review it.
5. Select Assign and edit the policy details. You can fine-tune, edit, and add custom rules to the policy.
6. Once you have completed reviewing, select Review + create.
7. Select Create to assign the policy.

Enable and configure with IaC templates

Bicep template

To enable and configure Microsoft Defender for Storage at the subscription level using Bicep, make sure your target scope is set to subscription, and add the following to your Bicep template:

resource StorageAccounts 'Microsoft.Security/pricings@2023-01-01' = { name: 'StorageAccounts' properties: { pricingTier: 'Standard' subPlan: 'DefenderForStorageV2' extensions: [ { name: 'OnUploadMalwareScanning' isEnabled: 'True' additionalExtensionProperties: { CapGBPerMonthPerStorageAccount: '5000' } } { name: 'SensitiveDataDiscovery' isEnabled: 'True' } ] }}

To modify the monthly cap for malware scanning per storage account, simply adjust the CapGBPerMonthPerStorageAccount parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.

If you want to turn off the On-upload malware scanning or Sensitive data threat detection features, you can change the isEnabled value to False under Sensitive data discovery.

To disable the entire Defender for Storage plan, set the pricingTier property value to Free and remove the subPlan and extensions properties.Learn more about the Bicep template AzAPI reference.

ARM template

To enable and configure Microsoft Defender for Storage at the subscription level using an ARM template, add this JSON snippet to the resources section of your ARM template:

{ "type": "Microsoft.Security/pricings", "apiVersion": "2023-01-01", "name": "StorageAccounts", "properties": { "pricingTier": "Standard", "subPlan": "DefenderForStorageV2", "extensions": [ { "name": "OnUploadMalwareScanning", "isEnabled": "True", "additionalExtensionProperties": { "CapGBPerMonthPerStorageAccount": "5000" } }, { "name": "SensitiveDataDiscovery", "isEnabled": "True" } ] }}

To modify the monthly threshold for malware scanning in your storage accounts, simply adjust the CapGBPerMonthPerStorageAccount parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.

If you want to turn off the On-upload malware scanning or Sensitive data threat detection features, you can change the isEnabled value to False under Sensitive data discovery.

To disable the entire Defender plan, set the pricingTier property value to Free and remove the subPlan and extensions properties.

Learn more in the ARM template reference.

Enable and configure with REST API

To enable and configure Microsoft Defender for Storage at the subscription level using REST API, create a PUT request with this endpoint (replace the subscriptionId in the endpoint URL with your own Azure subscription ID):

PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/pricings/StorageAccounts?api-version=2023-01-01

And add the following request body:

{ "properties": { "extensions": [ { "name": "OnUploadMalwareScanning", "isEnabled": "True", "additionalExtensionProperties": { "CapGBPerMonthPerStorageAccount": "5000" } }, { "name": "SensitiveDataDiscovery", "isEnabled": "True" } ], "subPlan": "DefenderForStorageV2", "pricingTier": "Standard" }}

To modify the monthly threshold for malware scanning in your storage accounts, simply adjust the CapGBPerMonthPerStorageAccount parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.

If you want to turn off the On-upload malware scanning or Sensitive data threat detection features, you can change the isEnabled value to False under Sensitive data discovery.

To disable the entire Defender plan, set the pricingTier property value to Free and remove the subPlan and extensions properties.

Learn more about the updating Defender plans with the REST API in HTTP, Java, Go and JavaScript.