services / Azure / Defender for Storage settings

The Microsoft Defender for Storage configuration for the scope, controlling on-upload malware scanning, sensitive-data threat detection, and activity monitoring for storage accounts.

This is a detection control over storage; disabling it removes malware/threat scanning coverage rather than altering stored data itself.

Microsoft.​Security/​defenderforstoragesettings/​write

Editing the settings can turn off malware scanning and threat detection for storage accounts, letting an attacker upload malicious or exfiltrate data without triggering storage threat alerts.

Risks

1. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links