services / Azure / Defender for Storage settings

The Microsoft Defender for Storage configuration for the scope, controlling on-upload malware scanning, sensitive-data threat detection, and activity monitoring for storage accounts.

This is a detection control over storage; disabling it removes malware/threat scanning coverage rather than altering stored data itself.

Microsoft.​Security/​defenderforstoragesettings/​delete

Deleting the Defender for Storage settings disables storage malware/threat scanning entirely, removing that detection control.

Risks

1. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links