Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_storage_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
forensics-readyResource type:
microsoft.security/pricingsWhat this check verifies
Azure subscription’s Defender for Storage plan is set toStandard for Storage Accounts.
Risk
Without Defender for Storage, suspicious access to blobs, files, and queues may go undetected. Compromised keys orSAS tokens can enable data exfiltration (confidentiality), object tampering (integrity), and mass deletion or ransomware-like encryption (availability).
Recommendation
Enable Defender for Storage at theStandard tier for subscriptions with storage workloads. Apply defense in depth: restrict network exposure, enforce least privilege on keys and SAS, use short-lived tokens and rotation, and route alerts to centralized monitoring for rapid response.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create -n StorageAccounts —tier Standard
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-storage.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_storage_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks