Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Set Up Automated Remediation for Malware Detection

4 September 2026Doc update+10 / −7 lines

In brief

The documentation now details remediation options, links ABAC setup to scan results, clarifies Logic App and Event Grid Function App guidance, and explains using blob copy operations. It also adds guidance for allowing downstream applications to process blobs only after a clean scan result.

What Defender admins need to know

Administrators have clearer instructions for configuring scan-based access control, automated remediation, event routing, and blob handling.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Defender for Storage Malware Protection has a built-in capability that simplifies and automates the remediation process for malicious blobs, so you reduce the risk of malware distribution. When Defender for Storage detects a malicious blob during on-upload or on-demand malware scanning, it automatically starts a soft delete to safely quarantine the blob and keep it recoverable for further analysis.

If you haven't enabled soft delete for blobs on the storage account, Defender for Storage enables it when you turn on the soft delete malicious blobs feature. ThisThe soft delete malicious blobs feature reduces setup steps and improves security response immediately.

:::image type="content" source="media/defender-for-storage-configure-malware-scan/defender-for-storage-settings-advanced-options.png" alt-text="Screenshot of Microsoft Defender for Storage advanced settings page.":::

Setting up custom remediation for malicious blobs

Use these optionsYou can automate remediation by blocking access to automate your remediation:unscanned or malicious files, deleting or moving malicious blobs, or routing clean files based on scan results:

Block access to unscanned or malicious files by using ABAC (attribute-based access control)

By using Microsoft Entra Attribute-based access control (ABAC) authorization, you can block access to malicious and unscanned files. You can set conditional access to blobs based on the scanning results, and allow applications and users to access only scanned files that are clean.

To set it up,up ABAC authorization for blob access based on scan results, follow the instructions in the following ABAC setup walkthrough for scan-based blob access control (video).

Delete or move a malicious blob

Option 1: Logic App based on Microsoft Defender for Cloud security alerts

Logic App based responses are a simple, no-code approach to setting up response.automated remediation responses. However, the response time is slower than thean event-driven code-Function App based approach.on Event Grid events.

  1. Deploy the DeleteBlobLogicApp Azure Resource Manager (ARM) template by using the Azure portal.

  2. Under Networking, allow access from public IP addresses. Private endpoint-only topics can't receive events from Defender for Storage.

  3. After creating the topic, copy the Topic Endpoint and access key — you need these to configure Defender for Storage.

To configure Defender for Storage to send scan results to yourthe Event Grid custom topic,topic you created, see Set up Event Grid for malware scanning.

Step 2: Create and configure the Function App

| Auto-delete malicious blobs | Use the move template as a base; replace the copy+delete logic with a direct Delete Blob call after checking scanResultType == "Malicious". Enable soft delete first to allow recovery if there are false positives. | | Send an alert or notification | Add an HTTP call to your alerting endpoint (for example, Teams webhook, PagerDuty, or ServiceNow) when scanResultType == "Malicious". See the Azure Functions HTTP output binding for details. |

Alternatively, use the Azure Storage blob copy operations to copy the blob elsewhere, then delete itthe blob from the source.

For each scan result, an event is sent according to the following schema.

Applications ingest data based on the scan result

Use these patterns to let downstream applications process blobs only after Defender for Storage malware scanning reports a clean result.

Option 1: Apps checking "Index tag" before processing

Update all applications that use the storage account. Each application checks the scan result for each file, and if the blob Index tag scan result is no threats found, the application reads the blob.