Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Enable Defender for Storage by Using Infrastructure as Code

4 September 2026Doc update+15 / −12 lines

In brief

The article description now references PowerShell and Azure Policy, code samples are labeled Bicep, the Terraform link wording was clarified, and deployment troubleshooting guidance was added.

What Defender admins need to know

Administrators can use the updated guidance to select the appropriate deployment method and troubleshoot common deployment issues.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

By customizing this code, you can:

  • Modify the monthly cap for malware scanning: Adjust the CapGBPerMonthPerStorageAccount parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limitvalue is 10,000 GB.-1.
  • Turn off the on-upload malware scanning or sensitive-data threat detection feature: Remove the corresponding extension block from the Terraform code.
  • Disable the entire Defender for Storage plan: Set the tier property value to "Free", and remove the subPlan and extension properties.

To learn more about the azurerm_security_center_subscription_pricing resource, refer to the Terraform documentation for azurerm_security_center_subscription_pricing. You can also find comprehensive details on the Terraform provider for Azure in the Terraform AzureRM documentation.

Bicep template

To enable and configure Defender for Storage at the subscription level by using Bicep, make sure your target scope is set to subscription. Add the following code to your Bicep template:

targetScope = 'subscription'

resource StorageAccounts 'Microsoft.Security/pricings@2023-01-01' = {

By customizing this code, you can:

- **Modify the monthly cap for malware scanning**: Adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value `-1`. The default limitvalue is 10,000 GB.-1.
- **Turn off the on-upload malware scanning or sensitive-data threat detection feature**: Change the `isEnabled` value to `False` under `SensitiveDataDiscovery`.
- **Disable the entire Defender for Storage plan**: Set the `pricingTier` property value to `Free`, and remove the `subPlan` and `extensions` properties.


By customizing this code, you can:

- **Modify the monthly cap for malware scanning**: Adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value `-1`. The default limitvalue is 10,000 GB.-1.
- **Turn off the on-upload malware scanning or sensitive-data threat detection feature**: Change the `isEnabled` value to `False` under `SensitiveDataDiscovery`.
- **Disable the entire Defender for Storage plan**: Set the `pricingTier` property value to `Free`, and remove the `subPlan` and `extension` properties.


By customizing this code, you can:

- **Modify the monthly cap for malware scanning**: Adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value `-1`. The default limitvalue is 10,000 GB.-1.
- **Turn off the on-upload malware scanning or sensitive-data threat detection feature**: Change the `isEnabled` value to `False` in the section for the `malwareScanning` or `sensitiveDataDiscovery` property.
- **Disable the entire Defender for Storage plan**: Use the following code snippet:


To enable and configure Defender for Storage at the storage account level by using Bicep, add the following code to your Bicep template:

```terraformbicep
resource storageAccount 'Microsoft.Storage/storageAccounts@2021-04-01' ...

resource defenderForStorageSettings 'Microsoft.Security/DefenderForStorageSettings@2022-12-01-preview' = {

By customizing this code, you can:

- **Modify the monthly cap for malware scanning**: Adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value `-1`. The default limitvalue is 10,000 GB.-1.
- **Turn off the on-upload malware scanning or sensitive-data threat detection feature**: Change the `isEnabled` value to `False` in the section for the `malwareScanning` or `sensitiveDataDiscovery` property.
- **Disable the entire Defender for Storage plan**: Set the `isEnabled` property value to `False`, and remove the `malwareScanning` and `sensitiveDataDiscovery` sections from the properties.


To enable and configure Defender for Storage at the storage account level by using an Azure Resource Manager template (ARM template), add this JSON snippet to the `resources` section of your ARM template:

```terraformjson
{
    "type": "Microsoft.Security/DefenderForStorageSettings",
    "apiVersion": "2022-12-01-preview",

By customizing this code, you can:

- **Modify the monthly cap for malware scanning**: Adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value `-1`. The default limitvalue is 10,000 GB.-1.
- **Turn off the on-upload malware scanning or sensitive-data threat detection feature**: Change the `isEnabled` value to `False` in the section for the `malwareScanning` or `sensitiveDataDiscovery` property.
- **Disable the entire Defender for Storage plan**: Set the `isEnabled` property value to `False`, and remove the `malwareScanning` and `sensitiveDataDiscovery` sections from the properties.


## Troubleshoot common issues

The following table lists common deployment issues, likely causes, and recommended resolutions.

| Issue | Likely cause | Resolution |
|---|---|---|
| Plan activation fails at subscription level | Insufficient permissions | Ensure you have the Security Admin or Owner role on the subscription. |