Microsoft Defender for Cloud
Cloud and workloadsIntroduction to Defender for Storage malware scanning
In brief
The page now explains scanning an entire storage account or targeted items, including individual blobs, containers, and path prefixes. It also adds supported content types and sizes, limitations, privacy and regional processing details, and an additional investigation use case.
What Defender admins need to know
Administrators can use the expanded guidance to choose scan scope and verify supported data, limitations, and processing considerations.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
On-upload malware scanning: Scans blobs automatically when they're uploaded or modified, providing fast detection. This type of scanning is ideal for applications that involve frequent user uploads, such as web applications or collaborative platforms. Scanning content as it's uploaded helps reduce the risk of malicious files entering your storage environment and propagating downstream.
On-demand malware scanning: Lets you
manuallyscan existing blobs and files wheneverneeded.needed - either the entire storage account or targeted items such as a single blob, a specific container, or objects matching a path prefix. This scanning type is used to establish a security baseline for stored data, respond to security alerts during incident response, support compliance requirements, and performproactivetargeted securitychecks across your environment.investigations.
These scanning modes help you protect your storage accounts, meet compliance needs, and maintain data integrity.
Key features
Malware scanning includes the following key capabilities:
- Built-in SaaS solution: Simple to enable with zero infrastructure maintenance.
- Advanced antimalware capabilities: Uses MDAV to detect polymorphic and metamorphic malware across all file types.
- Comprehensive detection: Scans all file types, including archives like ZIP and RAR files, up to 50 GB per blob and file.
Use on-upload malware scanning if you need protection against malicious uploads—ideal for web applications, user-generated content, partner integrations, or shared content pipelines. For more information, see On-upload malware scanning.
Use on-demand malware scanning when you need scanning flexibility—flexibility, for establishing security baselines, responding to alerts, preparing for audits, investigating a specific suspicious blob or file, or verifying stored data before archival or exchange. You can scan the entire storage account or use filters to target specific items. For more information, see On-demand malware scanning.
Malware scan results
Malware scan results are available through four methods. After setup, you'll see scan results as blob index tags for every scanned file, and as Microsoft Defender for Cloud security alerts when a file is identified as malicious. You can choose to disable the use of blob index tags in the Azure portal or through the REST API. You can also configure more scan result methods, such as Event Grid and Log Analytics, which require extra configuration. The next sections following sections—Blob index tags, Defender for Cloud security alerts, Event Grid events, and Log Analytics—describe each scan result method in more detail.
:::image type="content" source="media/defender-for-storage-malware-scan/view-and-consume-malware-scan-results.png" alt-text="Diagram showing flow of viewing and consuming malware scanning results." lightbox="media/defender-for-storage-malware-scan/view-and-consume-malware-scan-results.png":::
Supported content
The following content types and sizes are supported for malware scanning:
File types: All file types are supported, including compressed archives such as ZIP and RAR files.
File size: Blobs and files up to 50 GB can be scanned.
Limitations
Be aware of the following limitations when using malware scanning:
Unsupported storage accounts: Legacy v1 storage accounts aren’t supported.
Unsupported services: On-upload malware scanning isn't supported for Azure Files.
Data privacy and regional processing
Malware scanning handles data privacy and regional processing as follows:
Regional processing: Malware scanning is performed in the same Azure region as your storage account to support data residency and compliance requirements.
Data handling: Scanned files aren't stored by the service. In limited cases, file metadata such as the SHA-256 hash might be shared with Microsoft Defender for Endpoint for further analysis.
Related malware scanning content
For more information about malware scanning options, see the following resource:
Next stepsteps
[!div class="nextstepaction"] On-demand malware scanning in Microsoft Defender for Storage
@@ -1,8 +1,9 @@ --- title: Introduction to Defender for Storage malware scanning description: Discover how malware scanning in Microsoft Defender for Storage enhances security. It improves compliance and data integrity by detecting and mitigating threats.-ms.date: 05/28/2026+ms.date: 07/03/2026 ms.topic: how-to+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security administrator, I want to understand malware scanning in Defender for Storage so that I can enhance security and compliance. ai-usage: ai-assisted ---@@ -15,7 +16,7 @@ Defender for Storage offers two types of malware scanning: * [On-upload malware scanning](on-upload-malware-scanning.md): Scans blobs automatically when they're uploaded or modified, providing fast detection. This type of scanning is ideal for applications that involve frequent user uploads, such as web applications or collaborative platforms. Scanning content as it's uploaded helps reduce the risk of malicious files entering your storage environment and propagating downstream. -* [On-demand malware scanning](on-demand-malware-scanning.md): Lets you manually scan existing blobs and files whenever needed. This scanning type is used to establish a security baseline for stored data, respond to security alerts during incident response, support compliance requirements, and perform proactive security checks across your environment.+* [On-demand malware scanning](on-demand-malware-scanning.md): Lets you scan existing blobs and files whenever needed - either the entire storage account or targeted items such as a single blob, a specific container, or objects matching a path prefix. This scanning type is used to establish a security baseline for stored data, respond to security alerts during incident response, support compliance requirements, and perform targeted security investigations. These scanning modes help you protect your storage accounts, meet compliance needs, and maintain data integrity. @@ -35,6 +36,8 @@ Key benefits include: ## Key features +Malware scanning includes the following key capabilities:+ * **Built-in SaaS solution:** Simple to enable with zero infrastructure maintenance. * **Advanced antimalware capabilities:** Uses MDAV to detect polymorphic and metamorphic malware across all file types. * **Comprehensive detection**: Scans all file types, including archives like ZIP and RAR files, up to 50 GB per blob and file.@@ -50,11 +53,11 @@ Key benefits include: Use **on-upload malware scanning** if you need protection against malicious uploads—ideal for web applications, user-generated content, partner integrations, or shared content pipelines. For more information, see [On-upload malware scanning](on-upload-malware-scanning.md). -Use **on-demand malware scanning** when you need scanning flexibility—for establishing security baselines, responding to alerts, preparing for audits, or verifying stored data before archival or exchange. For more information, see [On-demand malware scanning](on-demand-malware-scanning.md).+Use **on-demand malware scanning** when you need scanning flexibility, for establishing security baselines, responding to alerts, preparing for audits, investigating a specific suspicious blob or file, or verifying stored data before archival or exchange. You can scan the entire storage account or use filters to target specific items. For more information, see [On-demand malware scanning](on-demand-malware-scanning.md). ## Malware scan results -Malware scan results are available through four methods. After setup, you'll see scan results as **blob index tags** for every scanned file, and as **Microsoft Defender for Cloud security alerts** when a file is identified as malicious. You can choose to disable the use of blob index tags in the Azure portal or through the REST API. You can also configure more scan result methods, such as **Event Grid** and **Log Analytics**, which require extra configuration. The next sections describe each scan result method in more detail.+Malware scan results are available through four methods. After setup, you'll see scan results as **blob index tags** for every scanned file, and as **Microsoft Defender for Cloud security alerts** when a file is identified as malicious. You can choose to disable the use of blob index tags in the Azure portal or through the REST API. You can also configure more scan result methods, such as **Event Grid** and **Log Analytics**, which require extra configuration. The following sections—Blob index tags, Defender for Cloud security alerts, Event Grid events, and Log Analytics—describe each method in more detail. :::image type="content" source="media/defender-for-storage-malware-scan/view-and-consume-malware-scan-results.png" alt-text="Diagram showing flow of viewing and consuming malware scanning results." lightbox="media/defender-for-storage-malware-scan/view-and-consume-malware-scan-results.png"::: @@ -146,12 +149,16 @@ These resources are required for malware scanning to function. If any of them ar ### Supported content +The following content types and sizes are supported for malware scanning:+ * **File types:** All file types are supported, including compressed archives such as ZIP and RAR files. * **File size:** Blobs and files up to 50 GB can be scanned. ### Limitations +Be aware of the following limitations when using malware scanning:+ * **Unsupported storage accounts:** Legacy v1 storage accounts aren’t supported. * **Unsupported services:** On-upload malware scanning isn't supported for Azure Files. @@ -224,6 +231,8 @@ If your storage account is configured to allow public network access only from s ### Data privacy and regional processing +Malware scanning handles data privacy and regional processing as follows:+ * **Regional processing:** Malware scanning is performed in the same Azure region as your storage account to support data residency and compliance requirements. * **Data handling:** Scanned files aren't stored by the service. In limited cases, file metadata such as the SHA-256 hash might be shared with Microsoft Defender for Endpoint for further analysis.@@ -250,11 +259,15 @@ A false negative occurs when a malicious file isn't detected. If you believe mal > [!NOTE] > Reporting false positives and false negatives helps improve detection accuracy over time. -## Learn more+<a name="learn-more"></a>+## Related malware scanning content++For more information about malware scanning options, see the following resource: - [On-upload malware scanning in Microsoft Defender for Storage](on-upload-malware-scanning.md) -## Next step+<a name="next-step"></a>+## Next steps > [!div class="nextstepaction"] > [On-demand malware scanning in Microsoft Defender for Storage](on-demand-malware-scanning.md)