Check ID: defender_ensure_defender_for_storage_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: forensics-ready
Resource type: microsoft.security/pricings

What this check verifies

Azure subscription’s Defender for Storage plan is set to Standard for Storage Accounts.

Risk

Without Defender for Storage, suspicious access to blobs, files, and queues may go undetected. Compromised keys or SAS tokens can enable data exfiltration (confidentiality), object tampering (integrity), and mass deletion or ransomware-like encryption (availability).

Recommendation

Enable Defender for Storage at the Standard tier for subscriptions with storage workloads. Apply defense in depth: restrict network exposure, enforce least privilege on keys and SAS, use short-lived tokens and rotation, and route alerts to centralized monitoring for rapid response.

Remediation

az security pricing create -n StorageAccounts —tier Standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_storage_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks