Configure malware scanning for an Azure Storage account

You have enabled Microsoft Defender for Storage and Malware Scanning. The scans are running, but detection alone is rarely enough; you need an automated response to contain the threat. The first decision is how your infrastructure reacts when a file is flagged as malicious. You can choose between a no-code Logic App approach driven by Defender for Cloud alerts, or a low-latency Function App approach driven by Event Grid events.

The prerequisite for configuring these responses is having Owner roles at the subscription or storage account level, or specific roles with the corresponding data actions Protect your storage accounts with the Microsoft Defender for Storage plan.

Prepare your environment

Before automating deletion or movement, consider enabling soft delete on the storage account. This allows you to undelete files in case of false positives or for forensic investigation Setting up response to Malware Scanning | Microsoft Defender for Storage.

If you choose to move malicious files to a quarantine container, restrict access to that container. Use Microsoft Entra ID and container-level RBAC assignments to ensure only security admins or SOC analysts can access the quarantine storage Setting up response to Malware Scanning | Microsoft Defender for Storage. Moving malicious files to a dedicated quarantine storage account is often safer than keeping them in the same account, as it limits the scope of potential access Setting up response to Malware Scanning | Microsoft Defender for Storage.

Option 1: Logic Apps via Defender for Cloud alerts

This is the simplest no-code approach. It relies on Microsoft Defender for Cloud generating a security alert when a malicious file is detected, which then triggers a Logic App Setting up response to Malware Scanning | Microsoft Defender for Storage. The response time is slower than event-driven approaches, but it requires less custom code.

To set this up, you need to deploy a Logic App and grant it permission to delete or move blobs. The documentation provides a pre-built ARM template for this purpose Setting up response to Malware Scanning | Microsoft Defender for Storage.

1. Deploy the DeleteBlobLogicApp template via the Azure portal Setting up response to Malware Scanning | Microsoft Defender for Storage.
2. Configure the Logic App’s identity. Go to Identity in the side menu and select Azure role assignments Setting up response to Malware Scanning | Microsoft Defender for Storage.
3. Assign the Storage Blob Data Contributor role at the specific storage account level Setting up response to Malware Scanning | Microsoft Defender for Storage. This limits the Logic App’s permissions to only the protected account, rather than the entire subscription, unless cross-account access is explicitly required and justified.
4. Create a workflow automation in Microsoft Defender for Cloud. Navigate to Workflow automation in the side menu and add a new workflow Setting up response to Malware Scanning | Microsoft Defender for Storage.
5. In the Alert name contains field, enter Malicious file uploaded to storage account and select your Logic App in the Actions section Setting up response to Malware Scanning | Microsoft Defender for Storage.

:::image type=“content” source=“/images/posts/2025/azc-218-learn-1.png” alt-text=“Screenshot that shows how to set up a role assignment for workflow automation to respond to scan results.”:::

Option 2: Function Apps via Event Grid

If you need low-latency responses, an Azure Function App triggered by Event Grid is more suitable Setting up response to Malware Scanning | Microsoft Defender for Storage. This approach consumes Event Grid events specifically generated for malware scanning results Setting up response to Malware Scanning | Microsoft Defender for Storage.

1. Create a Function App in the same resource group as your protected storage account Setting up response to Malware Scanning | Microsoft Defender for Storage.
2. Enable the system-assigned identity and assign the Storage Blob Data Contributor role at the storage account level Setting up response to Malware Scanning | Microsoft Defender for Storage.
3. Configure Event Grid to send events to the Function App Setting up response to Malware Scanning | Microsoft Defender for Storage.
4. Use the provided sample code MoveMaliciousBlobEventTrigger or write custom code to copy the blob to a quarantine container and then delete it from the source Setting up response to Malware Scanning | Microsoft Defender for Storage.

The Event Grid message structure includes the blob URI, scan result type, and malware names found Setting up response to Malware Scanning | Microsoft Defender for Storage. You can parse this JSON to determine the action Setting up response to Malware Scanning | Microsoft Defender for Storage.

Verify the response

To verify your configuration, upload a test file such as the EICAR test file Setting up response to Malware Scanning | Microsoft Defender for Storage. Monitor the Defender for Cloud alerts or Event Grid events to confirm the response action is triggered. Check the quarantine container or the deleted items in the source container to ensure the file was handled correctly Setting up response to Malware Scanning | Microsoft Defender for Storage.

Remember that Malware Scanning is charged per GB scanned. Set a monthly cap to control costs, as scanning will cease once the cap is reached Microsoft Defender for Storage - the benefits and features. The default cap is 5,000 GB per month per storage account Microsoft Defender for Storage - the benefits and features. Exceeding this limit pauses scanning for the remainder of the month, leaving new uploads unprotected. Monitor the ‘Malware Scanning stopped’ alert to ensure coverage is maintained, rather than just viewing the cap as a billing limit.

Once you have confirmed the response works for a single file, consider scaling the automation to handle your full storage estate. Use Azure Policy to enforce consistent malware scanning configurations across all subscriptions and storage accounts Protect your storage accounts with the Microsoft Defender for Storage plan.