Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Microsoft Defender for Storage on-demand malware scanning

4 September 2026New feature+132 / −10 lines

In brief

The documentation now describes scanning specific blobs, files, containers, file shares, or path prefixes through the REST API, in addition to scanning an entire storage account. It also documents portal initiation and retry scenarios for individual objects.

What Defender admins need to know

Administrators can investigate or rescan selected storage objects without rescanning the entire account; no required configuration change is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

On-demand malware scanning

On-demand malware scanning in Microsoft Defender for Storage enables you to scan existing blobs and files in your Azure Storage accounts whenever needed. You can scan an entire storage account, or target specific items using filters — such as a single blob or file, a specific container or file share, or items matching a path prefix. This capability provides flexibility to scan stored data in response to evolving security requirements, compliance needs, or security incidents, ensuring your data is continuously protected.

By using Microsoft Defender Antivirus with the latest malware definitions, on-demand scanning offers a cloud-native solution. It doesn't require extra infrastructure or operational overhead. This approachOn-demand malware scanning addresses gaps in coverage, especially for data uploaded before scanning was enabled. ItOn-demand scanning also helps when new threats emerge, allowing you to proactively secure stored files and reduce potential exposure in cloud environments.

Common use cases for on-demand malware scanning

Using on-demand malware scanning in Microsoft Defender for Storage offers the following advantages:

  • Respond to security events: Immediately scan storage accounts when security alerts or suspicious activities are detected.

  • Targeted investigation: Scan a specific blob, file, container, or file share; for example, to retry a failed scan, investigate a suspected false negative, or verify a single object after an alert

  • Re-scan after failure: Retry scanning a specific blob or file that previously failed during on-upload or on-demand scanning, without re-scanning the entire storage account.

  • Ensure compliance: Run scheduled or on-demand scans to meet data protection and regulatory compliance requirements.

  • Proactive security management: Set recurring scans to maintain a continuously secure environment.

  • Create a security baseline: Scan existing data upon first enabling Defender for Storage to establish a baseline for future security.

Shared aspects with on-upload scanning

The topics in the following sections of Introduction to malware scanning apply to both on-demand and on-upload malware scanning.

For detailed information on these topics,costs, scan results, remediation, limitations, privacy, false positives and negatives, and IOPS impact, see the Introduction to malware scanning.

Initiate on-demand scans

You can initiate on-demand scans from the Azure portal or programmatically by using the REST API.

Understand the on-demand scanning process

The on-demand scanning process includes the following stages and behaviors:

  • Cost estimation: Before you initiate a scan, the Azure portal estimates the cost based on the Storage Capacity metric and data volume. You get visibility into the potential scanning cost.

  • Scan initiation: You can start scans manually from the Azure portal, trigger them programmatically by using the REST API, or automate them through Logic Apps, Automation runbooks, or PowerShell scripts. You can integrate scanning into various workflows.

  • Listing and sending blobs for scanning: Once you initiate a scan, the system lists all supported blobs and files - either all items in the storage accountaccount, or only items matching your filters - and sends them for scanning in parallel. Depending on the number and size of objects, this process might take minutes to several hours.Data availability is unaffected; you can still access all items throughout the scanning process.

  • Monitoring progress: You can track scan progress through the Azure portal or API. You get details on the number of objects scanned, skipped objects, data volume, malicious objects detected, scan status, and duration.

  • Completion and results: After all objects are scanned, the system marks the scan as complete and provides a summary of findings. You can also use the API to query the details of the last scan.

Filter scans to specific items (Preview)

You can scope an on-demand scan to specific blobs or files instead of scanning the entire storage account. Filters are passed in the request body when initiating a scan via the REST API.

Supported filter scenarios:

ScenarioDescription
Single blob or fileScane one specific object using an exact path match.
Specific container of file shareScan all objects within a named container of file share.
Path prefixScan all objects whose path starts with a given prefix.

Filter rules:

  • Use the filters property in the request body to specify blobs and/or files entries.

  • Each entry contains a path object with a value (the full object path) and an optional match type (Exact or Prefix). If match is omitted, the default is Exact.

  • For blobs, the path.value represents the container name followed by the blob name, separated by / (for example, mycontainer/folder/file.txt).

  • For files, the path.value represents the share name followed by the file path within the share (for example, myshare/folder/report.docx).

  • All matching is case-sensitive.

  • When blob filters are provided, only blobs are scanned (file shares are skipped). When file filters are provided, only files are scanned (blobs are skipped).

  • If no objects match the filters, the scan completes successfully with zero scanned items.

  • If no filters are provided, the scan covers all blobs and files in the storage account (existing behavior).

Key considerations

Keep the following limitations and operational considerations in mind when using on-demand scans:

  • Single scan limitation: Only one on-demand scan can run at a time for each storage account.
  • Cancellation: You can cancel scans only during the initial stages of the scan.

Prerequisites

Before you initiate an on-demand scan, make sure the following prerequisites are met:

  • Permissions: The built-in Security Admin role can be used. For least privileged access create a custom role with the following permissions:

    • Microsoft.Security/defenderForStorageSettings/startMalwareScan/action

From the Azure portal

To initiate an on-demand scan from the Azure portal, follow these steps:

  1. Sign in to the Azure portal and go to your storage account.

  2. Under Security + networking, select Microsoft Defender for Cloud.

Use the REST API

You can also manage on-demand scans programmatically by using the REST API. The following subsections cover initiating, checking, and canceling scans.

Initiate the scan

To start a malware scan by using the REST API, follow these steps: Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOi... ```

Scan with filters

To scan specific items, include a filters property in the request body.

  • Scan a single blob:
{
  "properties": {
    "filters": {
      "blobs": [
        {
          "path": { "value": "mycontainer/document.pdf", "match": "Exact" }
        }
      ]
    }
  }
}
  • Scan all blobs with a path prefix:
{
  "properties": {
    "filters": {
      "blobs": [
        {
          "path": { "value": "mycontainer/uploads/", "match": "Prefix" }
        }
      ]
    }
  }
}
  • Scan all blobs in a specific container:
{
  "properties": {
    "filters": {
      "blobs": {
        "container": { "value": "mycontainer" }
      }
    }
  }
}
  • Scan a single file in Azure Files:
{
  "properties": {
    "filters": {
      "files": [
        {
          "path": { "value": "myshare/reports/quarterly.xlsx", "match": "Exact" }
        }
      ]
    }
  }
}

Check scan status and results

After you start a scan, use the following commands to check the status and review the results: GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}/providers/Microsoft.Security/defenderForStorageSettings/current/malwareScans/latest?api-version=2024-10-01-preview ```

  • Response example: The API returns a JSON response with the scan status and summary: 

      {
    "scanId": "abcd1234-5678-90ab-cdef-1234567890ab",
    "scanStatus": "InProgress",

Before starting an on-demand scan, the Azure portal provides a cost estimate based on the Storage Capacity metric, updated every few hours. The estimate is shown in USD and reflects the cost per GB scanned. Unlike on-upload scanning, there's no monthly cap and costs are entirely based on usage.

When using filters to scan a subset of items (such as a single blob or a specific container), the cost is based only on the data actually scanned, not the total storage account capacity.

Best practices for cost control

Use the following practices to help control on-demand scanning costs:

  • Review cost estimates: Always check the estimated cost in the Azure portal before initiating a scan.

  • Set scanning frequency wisely: Schedule or automate scans based on risk, focusing on high-priority data to avoid unnecessary costs.

  • Automate efficiently: Ensure automation triggers scans only when needed, such as in response to specific events or alerts.

  • Manage costs proactively: Always review cost estimates provided in the Azure portal before initiating scans, especially for large datasets or frequent scans.

  • Monitor results consistently: Continuously monitor scan outcomes and security alerts to stay informed about potential threats and take timely action.

  • Use filters for targeted scans: When investigating a specific blob or container, use the filter parameters to scope the scan and reduce both cost and scan time. This is especially useful for incident response or retrying failed scans.

Learn more

Next stepsteps

[!div class="nextstepaction"] On-upload malware scanning in Microsoft Defender for Storage