On-demand malware scanning

On-demand malware scanning in Microsoft Defender for Storage enables you to scan existing blobs and files in your Azure Storage accounts whenever needed. You can scan an entire storage account, or target specific items using filters — such as a single blob or file, a specific container or file share, or items matching a path prefix. This capability provides flexibility to scan stored data in response to evolving security requirements, compliance needs, or security incidents, ensuring your data is continuously protected.

By using Microsoft Defender Antivirus with the latest malware definitions, on-demand scanning offers a cloud-native solution. It doesn't require extra infrastructure or operational overhead. This approach addresses gaps in coverage, especially for data uploaded before scanning was enabled. It also helps when new threats emerge, allowing you to proactively secure stored files and reduce potential exposure in cloud environments.

Common use cases for on-demand malware scanning

Using on-demand malware scanning in Microsoft Defender for Storage offers the following advantages:

• Respond to security events: Immediately scan storage accounts when security alerts or suspicious activities are detected.

• Targeted investigation: Scan a specific blob, file, container, or file share; for example, to retry a failed scan, investigate a suspected false negative, or verify a single object after an alert

• Re-scan after failure: Retry scanning a specific blob or file that previously failed during on-upload or on-demand scanning, without re-scanning the entire storage account.

• Ensure compliance: Run scheduled or on-demand scans to meet data protection and regulatory compliance requirements.

• Proactive security management: Set recurring scans to maintain a continuously secure environment.

• Create a security baseline: Scan existing data upon first enabling Defender for Storage to establish a baseline for future security.

Malware can infiltrate cloud storage environments and pose significant risks to organizations. On-demand malware scanning provides a built-in, cloud-native solution to detect and mitigate these threats by scanning your existing data for malicious content.

Shared aspects with on-upload scanning

The following sections apply to both on-demand and on-upload malware scanning.

• Additional costs: Includes Azure Storage read operations, blob indexing, and Event Grid notifications.
• Viewing and consuming scan results: Methods such as Blob index tags, Defender for Cloud security alerts, Event Grid events, and Log Analytics.
• Malware remediation automation: Automate actions like blocking, deleting, or moving files based on scan results.
• Supported content and limitations: Covers supported file types, sizes, encryption, and region limitations.
• Access and data privacy: Details on how the service accesses and processes your data, including privacy considerations.
• Handling false positives and false negatives: Steps for submitting files for review and creating suppression rules.
• Blob scans and impact on IOPS: Learn how scans trigger further read operations and update blob index tags.

For detailed information on these topics, see the Introduction to malware scanning.

Initiate on-demand scans

Understand the on-demand scanning process

• Cost estimation: Before you initiate a scan, the Azure portal estimates the cost based on the Storage Capacity metric and data volume. You get visibility into the potential scanning cost.

• Scan initiation: You can start scans manually from the Azure portal, trigger them programmatically by using the REST API, or automate them through Logic Apps, Automation runbooks, or PowerShell scripts. You can integrate scanning into various workflows.

• Listing and sending blobs for scanning: Once you initiate a scan, the system lists supported blobs and files - either all items in the storage account, or only items matching your filters - and sends them for scanning in parallel. Depending on the number and size of objects, this process might take minutes to several hours. Data availability is unaffected; you can still access all items throughout the scanning process.

• Monitoring progress: You can track scan progress through the Azure portal or API. You get details on the number of objects scanned, skipped objects, data volume, malicious objects detected, scan status, and duration.

• Completion and results: After all objects are scanned, the system marks the scan as complete and provides a summary of findings. You can also use the API to query the details of the last scan.

Filter scans to specific items

You can scope an on-demand scan to specific blobs or files instead of scanning the entire storage account. Filters are passed in the request body when initiating a scan via the REST API.

Supported filter scenarios:

Filter rules:

• Use the filters property in the request body to specify blobs and/or files entries.

• Each entry contains a path object with a value (the full object path) and an optional match type (Exact or Prefix). If match is omitted, the default is Exact.

• For blobs, the path.value represents the container name followed by the blob name, separated by / (for example, mycontainer/folder/file.txt).

• For files, the path.value represents the share name followed by the file path within the share (for example, myshare/folder/report.docx).

• All matching is case-sensitive.

• When blob filters are provided, only blobs are scanned (file shares are skipped). When file filters are provided, only files are scanned (blobs are skipped).

• If no objects match the filters, the scan completes successfully with zero scanned items.

• If no filters are provided, the scan covers all blobs and files in the storage account (existing behavior).

Key considerations

• Single scan limitation: Only one on-demand scan can run at a time for each storage account.
• Cancellation: You can cancel scans only during the initial stages of the scan.

Prerequisites

• Permissions: The built-in Security Admin role can be used. For least privileged access create a custom role with the following permissions:

  • Microsoft.Security/defenderForStorageSettings/startMalwareScan/action

  • Microsoft.Security/defenderForStorageSettings/malwareScans/read

  • Microsoft.Security/defenderForStorageSettings/malwareScans/cancelMalwareScan/action

• Defender for Storage with on-upload malware scanning: Must be enabled on the subscription or individual storage account.

From the Azure portal

1. Sign in to the Azure portal and go to your storage account.

2. Under Security + networking, select Microsoft Defender for Cloud.

   

3. In the On-demand malware scanning section, check the estimated cost based on data volume.

   

4. Select Scan storage account for malware to start the scan. Confirm the action when prompted.

   

5. Monitor progress:

   • The scan status and findings update every 20-30 seconds.

   • You can view details such as scan status, objects scanned, GB scanned, threats found, and scan duration.

6. Review findings:

   • If the scan finds threats, review the details under the Security incidents and alerts section.

   • Refresh the page if you don't immediately see alerts.

   

Use the REST API

Initiate the scan

To start a malware scan by using the REST API, follow these steps:

• Request URL:

  POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}/providers/Microsoft.Security/defenderForStorageSettings/current/startMalwareScan?api-version=2024-10-01-preview
  

• Authentication:

  • Make sure you get a valid bearer token. You need this token to access the API.

• Example:

  POST https://management.azure.com/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount/providers/Microsoft.Security/defenderForStorageSettings/current/StartMalwareScan?api-version=2024-10-01-preview
  Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOi...
  

Scan with filters

To scan specific items, include a filters property in the request body.

• Scan a single blob:

{
  "properties": {
    "filters": {
      "blobs": [
        {
          "path": { "value": "mycontainer/document.pdf", "match": "Exact" }
        }
      ]
    }
  }
}

• Scan all blobs with a path prefix:

{
  "properties": {
    "filters": {
      "blobs": [
        {
          "path": { "value": "mycontainer/uploads/", "match": "Prefix" }
        }
      ]
    }
  }
}

• Scan all blobs in a specific container:

{
  "properties": {
    "filters": {
      "blobs": [
        {
          "path": { "value": "mycontainer", "match": "Exact" }
        }
      ]
    }
  }
}

• Scan a single file in Azure Files:

{
  "properties": {
    "filters": {
      "files": [
        {
          "path": { "value": "myshare/reports/quarterly.xlsx", "match": "Exact" }
        }
      ]
    }
  }
}

Check scan status and results

After you start a scan, use the following commands to check the status and review the results:

• Request URL:

  GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}/providers/Microsoft.Security/defenderForStorageSettings/current/malwareScans/latest?api-version=2024-10-01-preview
  

• Response example:

    {
      "scanId": "abcd1234-5678-90ab-cdef-1234567890ab",
      "scanStatus": "InProgress",
      "scanStartTime": "2024-10-03T12:34:56Z",
      "scanSummary": {
        "blobs": {
          "totalBlobsScanned": 150,
          "maliciousBlobsCount": 2,
          "skippedBlobsCount": 0,
          "scannedBlobsInGB": 10.5
        },
        "files": {
          "totalFilesScanned": 205
          "maliciousFilesCount": 1,
          "skippedFilesCount": 0,
          "failedFilesCount": 0,
          "scannedFilesInGB": 9.76
        }
        "estimatedScanCostUSD": 3.2
    }
  

Cancel a scan

You can cancel an in-progress scan only during its initial stages. Once the scan reaches the WaitingForCompletion state or beyond, you can't cancel it. To cancel the scan, send the following cancellation request:

• Request URL:

  POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}/providers/Microsoft.Security/defenderForStorageSettings/current/malwareScans/latest/cancelMalwareScan?api-version=2024-10-01-preview
  

Cost considerations

Before starting an on-demand scan, the Azure portal provides a cost estimate based on the Storage Capacity metric, updated every few hours. The estimate is shown in USD and reflects the cost per GB scanned. Unlike on-upload scanning, there's no monthly cap and costs are entirely based on usage.

When using filters to scan a subset of items (such as a single blob or a specific container), the cost is based only on the data actually scanned, not the total storage account capacity.

Best practices for cost control

• Review cost estimates: Always check the estimated cost in the Azure portal before initiating a scan.
• Set scanning frequency wisely: Schedule or automate scans based on risk, focusing on high-priority data to avoid unnecessary costs.
• Automate efficiently: Ensure automation triggers scans only when needed, such as in response to specific events or alerts.

Best practices

To maximize the effectiveness of on-demand malware scanning in Microsoft Defender for Storage, consider the following recommendations:

• Integrate with incident response: Use on-demand scanning to quickly address security incidents by scanning potentially compromised files in response to alerts.

• Automate compliance scans: Set up automated, regular scans to ensure ongoing compliance with regulatory requirements and audit readiness. Use Logic Apps or runbooks to streamline this process.

• Set up automated remediation for malware detection: Enable soft delete malicious blobs or configure automated workflows that remediate malware detection, such as moving infected files to quarantine or forwarding clean files.

• Manage costs proactively: Always review cost estimates provided in the Azure portal before initiating scans, especially for large datasets or frequent scans.

• Monitor results consistently: Continuously monitor scan outcomes and security alerts to stay informed about potential threats and take timely action.

• Use filters for targeted scans: When investigating a specific blob or container, use the filter parameters to scope the scan and reduce both cost and scan time. This is especially useful for incident response or retrying failed scans.

Learn more

• Introduction to malware scanning

Next step