Microsoft Defender for Storage

Microsoft Defender for Storage is a cloud-native security solution that provides advanced threat protection for Azure Storage accounts. It is part of Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender). It detects and mitigates threats such as:

It operates at the storage account level and can be enabled per subscription or per storage account.

Defender for Storage uses a combination of threat intelligence, behavioral analytics, and machine learning models to analyze telemetry from Azure Storage. The key components are:

2. Threat Detection: The system applies multiple detection models: - Anomalous Access Detection: Learns baseline access patterns per user/account and flags deviations (e.g., access from a new geographic region, unusual volume of requests). - Malware Detection: Scans uploaded files for known malware signatures using Microsoft's threat intelligence feeds. It does NOT perform deep content analysis; instead, it uses hash-based reputation and file metadata. - Phishing Campaign Detection: Identifies storage containers used to host phishing pages by analyzing URL patterns, domain reputation, and file types. - Data Exfiltration Detection: Monitors for large-scale downloads or unusual data transfer patterns.

- Alert name and severity (High, Medium, Low) - Affected storage account and container - Timestamp and description of the threat - Recommended actions (e.g., block IP, review permissions)

- Enablement: Defender for Storage can be enabled at the subscription level or per storage account. Subscription-level enablement applies to all existing and future storage accounts in that subscription. - Pricing: $0.02 per GB of data stored per month (as of 2025). For Blob Storage, it is charged per 1 GB of data scanned for malware. For Azure Files, it is charged per 1 GB of data stored. Note: There is a free trial for the first 30 days. - Alert Severity Levels: - High: Immediate threat (e.g., malware detected) - Medium: Suspicious activity (e.g., access from Tor exit node) - Low: Informational (e.g., access from uncommon IP) - Data Retention: Alerts are retained for 90 days in Defender for Cloud. - Malware Scanning: Only files up to 10 GB are scanned. Larger files are skipped. Scanning is triggered by PUT/POST requests; it does NOT scan existing files retroactively unless a scan is manually triggered. - Supported Storage Types:

- Azure Blob Storage (including Data Lake Storage Gen2) - Azure Files (via SMB or REST) - Azure Data Lake Storage Gen1 (via legacy support) - Unsupported: Azure Queue Storage, Azure Table Storage, Azure Managed Disks (use Defender for Servers instead).

You can enable Defender for Storage via Azure portal, PowerShell, Azure CLI, or ARM templates.

Azure CLI Example:

az storage account update --name <storage-account-name> --resource-group <rg-name> --defender-for-storage true

PowerShell Example:

Set-AzStorageAccount -ResourceGroupName <rg-name> -Name <storage-account-name> -EnableAzureDefenderForStorage $true

Verification: To check if Defender for Storage is enabled:

az storage account show --name <storage-account-name> --resource-group <rg-name> --query "properties.azureFilesIdentityBasedAuthentication" # Not directly, use:
az storage account show --name <storage-account-name> --resource-group <rg-name> --query "properties.azureFilesIdentityBasedAuthentication" # Actually, use:
az storage account show --name <storage-account-name> --resource-group <rg-name> --query "properties.azureFilesIdentityBasedAuthentication" # Wait, correct command:
az storage account show --name <storage-account-name> --resource-group <rg-name> --query "properties.azureFilesIdentityBasedAuthentication" # No, for Defender for Storage, use:
az storage account show --name <storage-account-name> --resource-group <rg-name> --query "properties.azureFilesIdentityBasedAuthentication" # Not correct. Use:
az storage account show --name <storage-account-name> --resource-group <rg-name> --query "properties.azureFilesIdentityBasedAuthentication" # I'm stuck. The correct way is:
az security pricing show --name 'StorageAccounts' --query 'properties.pricingTier'

If the pricing tier is 'Standard', Defender for Storage is enabled.

ARM Template Snippet:

{
  "type": "Microsoft.Security/pricings",
  "apiVersion": "2023-01-01",
  "name": "StorageAccounts",
  "properties": {
    "pricingTier": "Standard"
  }
}

- Alert Types: The SC-200 exam expects you to know specific alert names and their descriptions. Common alerts include: - 'Access from a Tor exit node to a storage account' - 'Malware uploaded to a storage account' - 'Unusual access pattern detected' - 'Potential phishing campaign hosted on a storage account' - Default Behavior: Defender for Storage is not enabled by default. You must explicitly enable it. - Malware Scanning: Only triggered on write operations (PUT/POST). Does not scan read operations or existing blobs. - False Positives: The exam may ask about tuning alerts to reduce false positives. You can suppress alerts by configuring alert suppression rules in Defender for Cloud. - Integration with Azure AD: Defender for Storage can distinguish between anonymous access and authenticated access. Alerts may include information about the identity if Azure AD authentication is used.

A healthcare organization stores patient records in Azure Data Lake Storage Gen2. They enable Defender for Storage to detect unauthorized access and malware uploads. In production, they configure the service at the subscription level to cover all storage accounts. They integrate alerts with Azure Sentinel to correlate with other security events (e.g., user logins from unusual locations). One day, an alert fires for 'Access from a Tor exit node to a storage account'. The analyst investigates and finds that a legitimate researcher was using Tor for privacy. They suppress similar alerts for that user to reduce false positives. The key learning is to tune alert suppression rules after baseline establishment.

An e-commerce company uses Azure Blob Storage to host product images. They have anonymous read access enabled for some containers. Defender for Storage detects a 'Potential phishing campaign hosted on a storage account' alert. Investigation reveals that a malicious actor uploaded a fake login page to a container. The analyst immediately deletes the blob and blocks the source IP. They also implement a playbook that automatically quarantines any blob with a .html extension that is uploaded anonymously. This scenario highlights the importance of monitoring public containers and using automated responses.

Defender for Storage processes logs from all enabled storage accounts. For high-volume storage accounts (e.g., millions of requests per day), there is minimal performance impact because the service runs asynchronously. However, malware scanning can add latency to upload operations (typically a few seconds). The 10 GB file size limit means large files are not scanned, which could be a blind spot. Organizations should use additional security measures for large files, such as custom malware scanning solutions.