Lesson 22 — Microsoft Defender for Storage
Azure Storage often contains the information an attacker actually wants: customer records, application uploads, backups, documents, data exports and operational files.
Microsoft Defender for Storage continuously analyses activity across supported Azure Storage services to identify suspicious access, malicious uploads, unusual data movement and threats involving sensitive information. It is an agentless cloud-native protection layer that works without requiring diagnostic logs to be enabled for its security analysis.
This lesson explains how Defender for Storage works, which storage services it protects, how threat detection and malware scanning operate, how sensitive data changes alert priority, and how Agent Foskett investigates suspicious access to a storage account.
What you will learn
This lesson moves from storage configuration into practical threat detection, malware scanning and investigation.
How Defender for Storage works
Core capabilities
| Capability | Purpose | Security value |
|---|---|---|
| Activity monitoring | Continuously analyses storage activity and configuration telemetry. | Detects unusual or malicious behaviour without deploying an agent. |
| Threat intelligence | Recognises malicious IP addresses, Tor exit nodes and suspicious applications. | Adds known-threat context to storage activity. |
| Behavioural analytics | Builds models of normal activity and identifies anomalies. | Detects activity that is suspicious even when the source is not already known. |
| On-upload malware scanning | Scans supported blobs when uploaded or modified. | Helps stop storage accounts becoming malware distribution points. |
| On-demand malware scanning | Scans selected existing storage content when required. | Supports incident response, validation and compliance activity. |
| Sensitive data threat detection | Adds data-sensitivity context to supported security findings. | Helps prioritise alerts where exposed data has greater business impact. |
Learning objectives
- Explain Defender for Storage.
- Identify protected storage services.
- Understand threat analytics.
- Explain malware scanning options.
- Recognise sensitive-data context.
- Investigate storage alerts.
- Apply storage security controls.
What is Defender for Storage?
Microsoft Defender for Storage is a Defender for Cloud plan that protects supported Azure Storage accounts against suspicious activity, malicious content and data-focused attacks.
Agentless protection
No security agent is installed inside a storage account. Microsoft analyses Azure platform telemetry and supported storage activity directly.
No diagnostic-log dependency
Defender for Storage does not require customers to enable storage diagnostic logs for its core security analysis. Diagnostic logging can still be valuable for broader operational and investigative requirements.
Protected services
- Azure Blob Storage
- Azure Files
- Azure Data Lake Storage
Feature coverage can vary by storage service and scanning method.
Data plane
Data-plane activity includes reading, writing, deleting and listing stored content. These operations reveal how users, applications and attackers interact with the data itself.
Control plane
Control-plane activity includes configuration changes such as modifying networking, keys, access settings or storage-account properties.
Threat intelligence
Microsoft threat intelligence helps identify connections from known malicious infrastructure, Tor exit nodes and other suspicious sources.
Behavioural detection
Statistical and machine-learning models identify activity that differs from the established pattern for the protected storage account.
Suspicious access
An alert may involve an unusual source, identity, authentication method, application, location or sequence of operations.
Data exfiltration indicators
- Large or unusual download volume
- Rapid enumeration followed by retrieval
- Access from unfamiliar networks
- Downloads outside expected business patterns
- Use of an unexpected SAS token or account key
Anonymous access
Public or anonymous blob access can expose data without requiring an authenticated identity. Defender alerts do not replace secure public-access configuration.
Shared Access Signatures
SAS tokens provide delegated access to storage resources. Excessive permissions, broad scope or long expiry periods can create substantial risk.
Storage account keys
Account keys provide powerful access and should be tightly controlled. Prefer Microsoft Entra ID and Azure RBAC where supported.
Microsoft Entra authentication
Identity-based access improves attribution and supports Conditional Access, role assignment and stronger governance.
On-upload malware scanning
Supported blobs are scanned when uploaded or modified. Microsoft Defender Antivirus is used to identify malicious content without requiring customer-managed scanning infrastructure.
On-demand malware scanning
On-demand scanning can inspect existing supported objects for incident response, compliance checks or proactive validation.
Scan result handling
Scan results can be integrated with applications and automation so malicious content can be quarantined, blocked, tagged or removed according to organisational policy.
Malware scanning limits
Security teams must understand supported object types, size limits, encrypted files, archive handling, monthly scanning caps and any additional charges before relying on scanning as an application control.
Application workflow
Applications that accept user uploads should not treat a successful upload as proof that the file is safe. Downstream processing should wait for the required scan outcome.
Quarantine design
Untrusted uploads can be placed in an isolated container or account until scanning and validation are complete.
Sensitive data threat detection
Data-sensitivity context helps security teams understand whether suspicious access affects information with greater confidentiality or regulatory importance.
Alert prioritisation
Two technically similar events may have very different business impact when one involves public marketing files and the other involves customer identity records.
Enablement scope
Defender for Storage can be enabled at subscription scope and configured for individual storage accounts where different settings are required.
Configuration consistency
Use policy, Infrastructure as Code and governance processes to prevent protection gaps across new subscriptions and storage accounts.
Cost governance
Review the Defender plan, malware-scanning volume, caps and expected workload behaviour. Cost controls should not create unmonitored high-risk storage accounts.
Network restrictions
Use storage firewalls, selected networks, private endpoints and trusted service exceptions carefully. Defender detects threats but does not replace network isolation.
Private endpoints
Private endpoints can keep supported storage access on private network paths and reduce public exposure.
Public network access
Disable public network access where it is not needed. Where public access is required, restrict it and monitor the permitted path.
Encryption
Azure Storage encryption protects data at rest. Customer-managed keys may provide additional control but require strong key governance and availability planning.
Soft delete and versioning
Recovery controls can help restore deleted or overwritten data after accidental change or malicious activity.
Immutable storage
Immutability policies can help protect regulated records and backups against alteration or deletion for a defined retention period.
Alert evidence
- Storage account and service
- Affected container, share or object
- Source IP and location
- Identity or authentication type
- Operation performed
- Time and sequence
- Threat-intelligence context
- Sensitive-data context
Initial investigation
Confirm whether the activity is expected, identify the owner, determine how access was authorised and establish which objects were affected.
Azure Activity Log
Review control-plane changes such as networking updates, key regeneration, Defender configuration and role assignments.
Resource logs
Where enabled and retained, storage resource logs can provide additional detail for operational investigation and correlation.
Identity investigation
Review sign-ins, role assignments, service principals, managed identities and any recent credential or permission changes.
Containment
- Disable public or anonymous access.
- Revoke or expire SAS tokens.
- Rotate exposed storage keys.
- Remove unnecessary role assignments.
- Restrict network access.
- Quarantine malicious objects.
- Disable compromised identities.
Validation after containment
Confirm that the original access path no longer works, monitoring remains enabled and business applications still use an approved secure method.
Agent Foskett investigation: “The files never left the server…”
Storage investigation checklist
| Area | Question | Evidence |
|---|---|---|
| Access method | Was access anonymous, SAS-based, key-based or identity-based? | Alert details, logs and application configuration. |
| Source | Is the IP, location, device or application expected? | Threat intelligence and historical activity. |
| Scope | Which accounts, containers, shares and objects were accessed? | Alert entities and retained logs. |
| Sensitivity | Did the affected content contain regulated or confidential data? | Data classification and sensitive-data context. |
| Persistence | Can the same credential or token still be used? | SAS validity, keys and role assignments. |
| Containment | Has the access path been removed without breaking approved workloads? | Connection tests and application validation. |
Key takeaways
- Defender for Storage protects supported Azure Storage services using agentless threat analysis.
- It analyses data-plane and control-plane telemetry without requiring diagnostic logs for its core protection.
- Threat intelligence and behavioural analytics identify suspicious access and data movement.
- On-upload and on-demand malware scanning help identify malicious stored content.
- Sensitive-data context improves alert prioritisation and incident understanding.
- Defender alerts supplement rather than replace secure identity, network and storage configuration.
- Microsoft Entra authentication and Azure RBAC provide better attribution than shared keys.
- SAS tokens must be narrowly scoped and short lived.
- Containment can require token revocation, key rotation, network restriction and identity remediation.
- Investigators must follow the data, not only the server or application that uses it.
What Agent Foskett checked
- Defender plan status
- Storage service
- Public access
- Network configuration
- Authentication method
- SAS permissions
- Account keys
- Identity and RBAC
- Affected objects
- Malware results
- Sensitive data
- Activity history
Best practices
- Enable protection at scale.
- Disable anonymous access.
- Prefer Entra authentication.
- Use private endpoints where practical.
- Keep SAS tokens short lived.
- Restrict network access.
- Scan untrusted uploads.
- Isolate files until scan completion.
- Use soft delete and versioning.
- Review alerts and scanning costs.
Related Agent Foskett resources
Continue learning
What is Microsoft Defender for Storage?
Microsoft Defender for Storage is a Microsoft Defender for Cloud plan that protects supported Azure Storage services through agentless threat detection, malware scanning and sensitive data threat detection.
Microsoft Defender for Storage Lesson
This Agent Foskett lesson explains storage threat analytics, suspicious access, malware scanning, sensitive data, SAS-token risk, investigation, containment and Azure Storage security best practices.
