Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Enable and configure Microsoft Defender for Storage (classic)

4 September 2026Doc updateAction required+37 / −23 lines

In brief

The page now clarifies that classic-plan users must migrate to access malware scanning, sensitive data threat detection, and per-storage-account pricing. It also expands instructions for excluding storage accounts, including tagging accounts and disabling protection with PowerShell or Azure CLI.

What Defender admins need to know

Administrators seeking those capabilities must migrate. When excluding accounts, add the AzDefenderPlanAutoEnable tag and disable protection to prevent subscription policies from re-enabling it.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

You can also upgrade from Defender for Storage (classic) to the Microsoft Defender for Storage plan and use advanced security capabilities, including malware scanning and sensitive data threat detection. Benefit from a predictable and granular pricing structure that charges per storage account, with extra costs for high-volume transactions. This newThe Microsoft Defender for Storage pricing plan also encompasses all new security features and detections.

Microsoft Defender for Storage is an Azure-native security intelligence layer that detects unusual and potentially harmful attempts to access or exploit your storage accounts. It uses advanced threat detection capabilities and Microsoft Defender Threat Intelligence data to provide contextual security alerts. These alerts include steps to mitigate detected threats and prevent future attacks.

Learn more about the benefits, features, and limitations of Defender for Storage. You can also learn more about Defender for Storage in the Defender for Storage episode of the Defender for Cloud in the Field video series.

Availability and pricing for Defender for Storage (classic)

The following table summarizes availability, pricing, supported storage types, and cloud support for Defender for Storage (classic).

Aspect Details

ARM template

To enable Microsoft Defender for Storage for a specific storage account with per-transaction pricing using an ARM template, use the ARM template for enabling Storage Advanced Threat Protection.

If you want to disable Defender for Storage on thea specific storage account:

  1. Sign in to the Azure portal.

  2. Navigate to your storage account.

    Replace <subscriptionId>, <resource-group>, and <storage-account> with the values for your environment.

If you want to disable per-transaction pricing for a specific storage account, use the Disable-AzSecurityAdvancedThreatProtection cmdlet:cmdlet. This command removes Defender for Storage (classic) protection from the specified storage account: 

Disable-AzSecurityAdvancedThreatProtection -ResourceId "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>/"

Learn more about thein Use PowerShell with Microsoft Defender for Cloud.

Azure CLI

Excluded storage accounts in the Defender for Storage classic are not automatically excluded when you migrate to the new plan.

Exclude an Azure Storage account from protection on a subscription with per-transaction pricing

To exclude an Azure Storage account from Microsoft Defender for Storage (classic), you can use:

Use PowerShell to exclude an Azure Storage account

Use the following steps to exclude a storage account from Defender for Storage (classic) protection by tagging the account and disabling protection with PowerShell.

  1. If you don't have the Azure Az PowerShell module installed, install it using install the Azure Az PowerShell module.

  2. Using an authenticated account, connect to Azure with the Connect-AzAccount cmdlet, as explained in Sign in with Azure PowerShell.

    Update-AzTag -ResourceId -Tag @{"AzDefenderPlanAutoEnable" = "off"} -Operation Merge 

    
If you skip this stage,don't add the `AzDefenderPlanAutoEnable` tag, your untagged resources continue receiving daily updates from the subscription level enablement policy. That policy enables Defender for Storage again on the account. Learn more about tags in [Use tags to organize your Azure resources and management hierarchy](/azure/azure-resource-manager/management/tag-resources).

  3. Disable Microsoft Defender for Storage for the desired account on the relevant subscription with the Disable-AzSecurityAdvancedThreatProtection cmdlet (using the same resource ID):

    Disable-AzSecurityAdvancedThreatProtection -ResourceId 

    
[Learn more about thisthe Disable-AzSecurityAdvancedThreatProtection cmdlet](/powershell/module/az.security/disable-azsecurityadvancedthreatprotection).

Use Azure CLI to exclude an Azure Storage account

Use the following steps to exclude a storage account from Defender for Storage (classic) protection by tagging the account and disabling protection with Azure CLI.

  1. If you don't have Azure CLI installed, install it using the instructions from the Azure CLI documentation.

  2. Using an authenticated account, connect to Azure with the login command as explained in Sign in with Azure CLI and enter your account credentials when prompted: az tag update --resource-id MyResourceId --operation merge --tags AzDefenderPlanAutoEnable=off 

    
If you skip this stage,don't add the `AzDefenderPlanAutoEnable` tag, your untagged resources continue receiving daily updates from the subscription level enablement policy. That policy enables Defender for Storage again on the account.

Exclude an Azure Databricks Storage account

You can exclude Azure Databricks workspace storage accounts from Defender for Storage (classic) protection by applying the AzDefenderPlanAutoEnable tag to the workspace. You can exclude an active workspace or prevent autoenabling on a new workspace.

Exclude an active Databricks workspace

Microsoft Defender for Storage can exclude specific active Databricks workspace storage accounts, when the plan is already enabled on a subscription.

  1. Re-enable Defender for Storage (classic) using one of the supported methods (you can’t enable Defender for Storage classic from the Azure portal).

The tags areAzDefenderPlanAutoEnable tag is inherited by the Storagestorage account of the Databricks workspace and preventprevents Defender for Storage from turning on.

To prevent auto-enabling on a new Databricks workspace storage account:

  1. Create a new Azure Databricks workspace to create a new Azure Databricks workspace..

  2. In the Tags tab, enter a tag named AzDefenderPlanAutoEnable.

  3. Continue following the instructions to create your new Azure Databricks workspace.

The Microsoft Defender for Storage account inherits the AzDefenderPlanAutoEnabletag offrom the Databricks workspace, which prevents Defender for Storage from turning on automatically.

Disable Microsoft Defender for Storage (classic)

You can disable Defender for Storage (classic) at the subscription level using one of the following tools and templates.

Disable per-transaction pricing for a subscription

You can disable Defender for Storage (classic) per-transaction pricing at the subscription level by using any of the following methods:

Terraform template

To disable Microsoft Defender for Storage (classic) at the subscription level with per-transaction pricing using a Terraform template, add this code snippet to your template with your subscription ID as the parent_id value:value. The snippet sets the Microsoft.Security/pricings resource for StorageAccounts to the Free tier, which disables Defender for Storage (classic) for the subscription: 

resource "azapi_resource" "symbolicname" {

#### Bicep template

To disable Microsoft Defender for Storage (classic) at the subscription level with per-transaction pricing using [Bicep](/azure/azure-resource-manager/bicep/overview), add the following to your Bicep template:template. This snippet deploys the `Microsoft.Security/pricings` resource with `pricingTier` set to `Free`, which disables Defender for Storage (classic) for the subscription:

```bicep
resource symbolicname 'Microsoft.Security/pricings@2022-03-01' = {

#### ARM template

To disable Microsoft Defender for Storage (classic) at the subscription level with per-transaction pricing using an ARM template, add this JSON snippet to the resources section of your ARM template:template. The snippet sets the `Microsoft.Security/pricings` resource for `StorageAccounts` to the `Free` pricing tier, which disables Defender for Storage (classic) for the subscription:

```json
{

To disable the plan,Defender for Storage (classic), set the --tier property value to free.

Learn more about the az security pricing create command.

REST API

To enable Microsoft Defender for Storage at the subscription level with per-transaction pricing using the Microsoft Defender for Cloud REST API, create a PUT request with this endpoint and body:body. The following example shows the full REST request, including the endpoint URL and the JSON request body that sets the pricingTier to Standard with the PerTransaction subplan:

PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/pricings/StorageAccounts?api-version=2022-03-01

Replace `{subscriptionId}` with your subscription ID.

To disable Defender for Storage (classic) at the plan,subscription level, set the `-pricingTier` property value to `Free` and remove the `subPlan` parameter.

Learn more about the [updating Defender plans with the REST API](/rest/api/defenderforcloud-composite/pricings/update?view=rest-defenderforcloud-composite-latest&tabs=HTTP&preserve-view=true) in HTTP, Java, Go and JavaScript.