Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Microsoft Defender for Storage on-upload malware scanning

4 September 2026Doc update+27 / −10 lines

In brief

The article now clarifies enablement prerequisites and supported configuration methods, adds an overview of upload triggers and scanning stages, and updates links to costs, results, limitations, and privacy information.

What Defender admins need to know

Administrators can use the revised guidance to find setup requirements and operational details; no configuration change is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

On-upload malware scanning

On-upload malware scanning in Microsoft Defender for Storage

On-upload malware scanning in Microsoft Defender for Storage automatically scans blobs when they're uploaded or modified, providing fast detection of malicious content. This cloud-native, SaaS-based solution uses Microsoft Defender Antivirus to perform comprehensive malware scans, ensuring your storage accounts remain secure without the need for extra infrastructure or maintenance.

By integrating on-upload scanning into your storage accounts, you can:

Common use cases for on-upload malware scanning

On-upload malware scanning supports a variety of scenarios, including:

  • Web applications: Secure user-generated content uploads in web applications such as tax apps, CV upload sites, and receipt uploads.

  • Content distribution: Protect assets like images and videos shared at scale through content hubs or CDNs (Content Delivery Networks), which can be common malware distribution points.

  • Compliance requirements: Meet regulatory standards, such as NIST (glossary definition), SWIFT, HIPAA and DORA, by scanning untrusted content, especially for regulated industries.

  • Third-party integration: Ensure third-party data, such as content from business partners or contractors, is scanned to prevent security risks.

  • Collaborative platforms: Ensure safe collaboration across teams and organizations by scanning shared content.

Enable on-upload malware scanning

You can enable on-upload malware scanning by using the Azure portal, PowerShell, Infrastructure as Code templates, or the REST API. Before you begin, review the following prerequisites.

Prerequisites

Before you enable on-upload malware scanning, make sure the following prerequisites are met:

  • Permissions: Owner or Contributor role on the subscription or storage account, or specific roles with the permissions required for Defender for Storage.

  • Defender for Storage: Must be enabled on the subscription or individual storage accounts.

  • Microsoft.EventGrid provider: Must be registered in the Azure Subscription.

  • Using PowerShell

  • Directly with the REST API

When malware scanning is enabled, an Event Grid System Topic resource is automatically created in the same resource group as the storage account. This Event Grid System Topic resource is used by the malware scanning service to listen to blob upload triggers.

For detailed instructions, see Deploy Microsoft Defender for Storage.

Malware scanning is billed per GB scanned. To provide cost predictability, malware scanning supports setting a cap on the amount of GB scanned in a single month per storage account.

The capping mechanism sets a monthly scanning limit, measured in gigabytes (GB), for each storage account. This monthly scanning limit serves as an effective cost control measure. If a predefined scanning limit is reached for a storage account within a single calendar month, the scanning operation automatically halts. ThisThe scanning halt occurs once the threshold is reached, with up to a 20-GB deviation. Files aren't scanned for malware beyond this point.after the monthly scanning limit is reached. The cap resets at the end of every month at midnight UTC. Updating the cap typically takes up to an hour to take effect.

By default, a limit of 10 TB (10,000 GB) is established if no specific capping mechanism is defined.

How malware scanning works

The following sections explain how on-upload malware scanning is triggered and how the scanning pipeline processes blobs.

On-upload malware scanning flow

On-upload scans are triggered by any operation that results in a BlobCreated or in a BlobRenamed event, as specified in the Azure Blob Storage as an Event Grid source documentation. These operations include:

Scanning process

When a blob upload or modification is detected, the scanning process consists of the following stages:

  1. Event detection: When a BlobCreated or a BlobRenamed event occurs, the malware scanning service detects the change.
  2. Blob retrieval: The service securely reads the blob content within the same region as your storage account.
  3. In-memory scanning: The content is scanned in-memory using Microsoft Defender Antivirus with up-to-date malware definitions.

Shared aspects with on-demand scanning

The following sections are applicableapply to both on-demand and on-upload malware scanning.

Best practices and tips

Use the following best practices to improve protection, cost management, and operational response:

  • Set cost control caps for storage accounts, particularly those with high upload traffic, to manage and optimize expenses effectively.
  • Use Log Analytics to track scan history for compliance and auditing purposes.
  • If your use case requires a malware remediation mechanism, consider using either the built-in soft delete malicious blobs feature or setting up automated remediation (for example, quarantine or deletion actions) using Event Grid and Logic Apps. For detailed setup guidance, see Set up remediation in malware scanning.

Next steps

To learn more about malware scanning in Microsoft Defender for Storage, see the following articles: