We value your privacy

We use cookies to analyse site traffic and improve your experience. You can accept all cookies or reject non-essential ones. See our Privacy Policy for details.

GR IT SERVICES
  • Contact
Get a quote
  2. Microsoft security
  3. Defender for Storage
Microsoft Defender for Storage, UAE

Malware scanning stops at 10,000 GB per storage account per month, by default, and then simply stops.

That default cap exists for cost predictability and it means uploads past the threshold go unscanned for the rest of the month. Defender for Storage is genuinely good protection for Blob, Files and Data Lake, and the configuration decisions determine how much of it you actually get.

Book a storage protection reviewSee what it covers
Microsoft Defender for Storage for UAE organisations
  • 10,000 GBDefault monthly scan cap per storage account
  • 3 servicesBlob Storage, Files and Data Lake Storage
  • AgentlessEnable at subscription, resource or scale
  • No logs neededDiagnostic logs are not a prerequisite
What Defender for Storage does

Eight things that determine how much protection you actually get.

Enabling the plan is a single action. Getting full value depends on four or five configuration decisions, and the default settings on two of them silently reduce coverage in ways nothing alerts you to until it has already happened.

Coverage across three storage services

It analyses data plane and control plane telemetry from Azure Blob Storage, Azure Files and Azure Data Lake Storage. That combination matters because most organisations think of storage protection as a blob problem and have file shares carrying just as much sensitive material.

Malware scanning using Defender Antivirus

Full malware scanning on uploaded objects, or on demand with targeted scans of specific blobs, files, containers or file shares, applying Microsoft Defender Antivirus capabilities. It is agentless, and it is the feature that stops a storage account becoming an entry and distribution point.

The monthly cap, which is on by default

The limit is set to 10,000 GB of uploaded blobs per month per storage account by default. Once exceeded, scanning ceases for the remaining blobs, with a 20 GB confidence interval. Nothing about that state is obvious unless you configured the alerts that warn about it.

Sensitive data threat detection at no extra cost

Powered by Sensitive Data Discovery, an agentless engine using smart sampling to find resources holding sensitive data, integrating with Microsoft Purview sensitive information types and classification labels. Microsoft states it can be enabled or disabled at no additional cost, so there is little reason to leave it off.

Detecting activity from entities with no identity

It detects suspicious activities from entities without identities accessing data through misconfigured and overly permissive shared access signatures, which may have been leaked or compromised. In estates that hand out SAS tokens freely, this is frequently the most valuable detection of the set.

Event driven response for actual remediation

Integration with Azure Event Grid triggers automated remediation, connecting Azure Functions or Logic Apps to auto-delete, quarantine or alert on malicious blobs in near real time. Detection without that is a notification. With it, the malicious object stops being reachable.

Activity monitoring without turning on logs

Continuous analysis of data and control plane logs with no need to turn on resource logs, using threat intelligence to identify suspicious signatures such as malicious IP addresses and Tor exit nodes. Microsoft states activity monitoring does not affect performance, ingestion capacity or data access.

Enabling it at scale and keeping it enabled

Subscription level enablement covers all existing and new storage accounts automatically and is the recommended approach. Azure Policy can enforce enablement on new subscriptions and help prevent configuration drift, which is what stops coverage decaying as the estate grows.

The default that reduces coverage silently

Past 10,000 GB in a month, scanning stops until the month rolls over.

The cap exists to make costs predictable, which is reasonable. What is not reasonable is finding out about it after an unscanned upload became a problem.

  • By default the limit is 10,000 GB of uploaded blobs per month per storage account. Once that threshold is exceeded, scanning ceases for the remaining blobs, with a 20 GB confidence interval. The account is still protected by activity monitoring, but new uploads are not being scanned.
  • Two alerts exist for exactly this, and they are worth routing somewhere a person reads. The first fires at 75 per cent of the monthly cap, giving time to adjust it. The second fires when the cap is reached and scanning is paused, and it includes the affected storage accounts.
  • The cap can be set subscription wide or per storage account, and under a protected subscription individual accounts can carry different limits. An account receiving large volumes of untrusted uploads should not share a cap with one that receives almost nothing.
  • Also worth knowing for cost modelling: malware scanning incurs additional charges for other Azure services, specifically Azure Storage read operations, Azure Storage blob indexing and Azure Event Grid notifications. Those are outside the plan itself and belong in the estimate.
Ask us to size your scan caps
How we approach it

Four things that turn this from enabled to effective.

Defender for Storage is unusually easy to turn on, which is why so many tenants have it on and configured entirely at defaults. The gap between those two states is where the work is.

We size the scan cap per account rather than accepting the default

The default is 10,000 GB of uploaded blobs per month per storage account, and once exceeded scanning ceases for the remaining blobs. Accounts receiving heavy untrusted uploads need a higher cap or the protection lapses part way through every month without anybody noticing.

We build the response, not just the detection

Event Grid integration with a Function or Logic App can auto-delete or quarantine a malicious blob in near real time. Without it, a malicious object stays downloadable while somebody reads an alert. That difference is the whole value of the malware scanning feature.

We turn on the feature that costs nothing

Sensitive data threat detection can be enabled or disabled at no additional cost, and it uses Sensitive Data Discovery with Purview sensitive information types and classification labels. Leaving it off means alerts arrive without the context of whether the data at risk actually mattered.

We check what hash reputation cannot see

Hash reputation analysis is available in all plans and has documented gaps: SMB file shares and blobs created using Put Block and Put Block List are unsupported use cases. Organisations relying on it for file shares are relying on something that does not cover them.

How a deployment runs

Four phases across roughly four weeks.

Fast, because enablement is agentless and can be done at subscription scale. The time goes into sizing the caps correctly and building the response path so detections become actions.
  1. 01
    Week 1

    Inventory storage and understand the upload profile

    Which storage accounts exist, which hold sensitive material, which receive uploads from outside the organisation, and roughly what volume each takes per month. That last number is what determines whether the default cap is generous or restrictive for a given account.

    • Storage account inventory across subscriptions
    • Accounts receiving untrusted uploads identified
    • Monthly upload volume estimated per account
    • Classic plan usage identified for migration
  2. 02
    Week 2

    Enable at subscription scope and set caps deliberately

    Subscription level enablement so existing and new accounts are covered automatically, with exclusions where genuinely justified. Caps set per account against the upload profile rather than left at the default for everything.

    • Plan enabled at subscription level
    • Exclusions documented with reasons
    • Scan caps set per account against volume
    • Sensitive data threat detection enabled
  3. 03
    Week 3

    Build the response path

    Event Grid integration with a Function or Logic App to auto-delete, quarantine or alert on malicious blobs. Without this, a detection is a message in a portal, and the malicious object remains exactly where somebody can download it.

    • Event Grid integration configured
    • Automated remediation action chosen and built
    • Quarantine location and retention defined
    • Response tested with a benign test file
  4. 04
    Week 4

    Route the alerts and prevent drift

    Both cap alerts routed to somebody who can act, security alerts integrated with wherever your team works, and Azure Policy configured to enforce enablement on new subscriptions so coverage does not decay as the estate grows.

    • Cap alerts routed to a named owner
    • Security alerts integrated with the SOC workflow
    • Azure Policy enforcing enablement on new subscriptions
    • Coverage reporting established
Where this matters

Six situations where storage is the exposure.

The common thread is a storage account that receives content from outside the organisation, or holds sensitive data that would matter if it left.

A business accepting customer file uploads

Any application that lets somebody outside the organisation upload a file into storage is accepting untrusted content by definition. Malware scanning on upload, with Event Grid remediation to quarantine anything malicious, is the direct control, and the cap needs sizing for the volume.

A regulated firm with a data exfiltration concern

Activity monitoring detects unusual access patterns and potential exfiltration, and sensitive data threat detection prioritises alerts by the sensitivity of the data at risk. Together they answer a supervisory question about detecting data leaving, with alerts rather than assurances.

An organisation handing out shared access signatures

Defender for Storage detects suspicious activity from entities without identities using misconfigured and overly permissive SAS tokens, which may be leaked or compromised. For estates where SAS tokens are issued casually, this is often the detection that finds something real first.

A provider storing records in Azure Files

File shares carry as much sensitive material as blob containers and receive far less attention. Coverage includes Azure Files, and it is worth confirming rather than assuming, particularly where hash reputation analysis is being relied on and SMB file shares are an unsupported use case for it.

An operator ingesting data from field systems

Data Lake Storage receiving telemetry and files from operational systems is a path into the environment from equipment that is rarely as well secured as the corporate estate. Coverage extends to Data Lake Storage, and activity monitoring works without enabling diagnostic logs.

A company whose Azure estate keeps growing

New subscriptions appear, storage accounts are created by project teams, and coverage decays quietly. Azure Policy can automatically enforce enablement on new subscriptions and help prevent configuration drift, which turns coverage from a periodic clean-up into a property of the platform.

Three positions

How UAE organisations protect Azure storage.

The middle column is where most enabled tenants sit: the plan is on, the defaults are untouched, and nobody has built the path from detection to action.
Blob, Files and Data Lake covered
Enabled and configuredYes
Enabled at defaultsYes
Not enabledNo
Malware scanning active
Enabled and configuredYes
Enabled at defaultsUntil the cap
Not enabledNo
Caps sized to upload volume
Enabled and configuredPer account
Enabled at defaultsDefault everywhere
Not enabledNot applicable
Cap alerts routed
Enabled and configuredYes
Enabled at defaultsNo
Not enabledNot applicable
Sensitive data detection on
Enabled and configuredYes
Enabled at defaultsSometimes
Not enabledNo
SAS abuse detected
Enabled and configuredYes
Enabled at defaultsYes
Not enabledNo
Malicious blob removed automatically
Enabled and configuredEvent Grid remediation
Enabled at defaultsNo
Not enabledNo
New subscriptions covered
Enabled and configuredAzure Policy enforced
Enabled at defaultsManual
Not enabledNo
Additional Azure charges modelled
Enabled and configuredYes
Enabled at defaultsNo
Not enabledNot applicable
Storage as a distribution point
Enabled and configuredAddressed
Enabled at defaultsPartly
Not enabledUnaddressed
Feature
Enabled and configured
Enabled at defaults
Not enabled
Blob, Files and Data Lake covered
YesYesNo
Malware scanning active
YesUntil the capNo
Caps sized to upload volume
Per accountDefault everywhereNot applicable
Cap alerts routed
YesNoNot applicable
Sensitive data detection on
YesSometimesNo
SAS abuse detected
YesYesNo
Malicious blob removed automatically
Event Grid remediationNoNo
New subscriptions covered
Azure Policy enforcedManualNo
Additional Azure charges modelled
YesNoNot applicable
Storage as a distribution point
AddressedPartlyUnaddressed
Two different malware capabilities

Malware scanning against hash reputation analysis.

They are frequently confused, and the difference decides whether an uploaded file is actually inspected or merely compared against a list of known hashes.
ConsiderationMalware scanningHash reputation analysis
MethodMicrosoft Defender Antivirus, deep file scanHash compared against known malware
Includes hash reputationYes, incorporatedIt is the whole method
Plan availabilityNew plan only, paid featureAvailable in all plans
ScopeBlob storageBlob storage and Azure Files
SMB file sharesNot in scope of this comparisonUnsupported use case
Blobs created with Put Block and Put Block ListNot in scope of this comparisonUnsupported use case
Catches unknown malwareYes, content is analysedNo, only known hashes
On demand scanningYes, targeted blobs, files, containers, sharesNo
Monthly cap appliesYes, 10,000 GB by defaultNo
Additional Azure chargesRead operations, blob indexing, Event GridNone stated
How an engagement runs

Five steps, and two of them are about defaults.

Enablement takes minutes. Sizing the caps and building the remediation path is what determines whether the plan protects anything or merely reports on it.
  1. 1

    Inventory storage and profile the uploads

    Every storage account across subscriptions, which hold sensitive data, which receive uploads from outside the organisation, and the approximate monthly upload volume for each. That volume figure is what makes the cap decision possible rather than arbitrary.

  2. 2

    Enable at subscription scope, with justified exclusions

    Subscription level enablement is recommended so all existing and new storage accounts are covered automatically. Any exclusion gets a recorded reason, because an excluded account looks identical to a covered one in every summary view.

  3. 3

    Set caps per account and enable sensitive data detection

    Caps set against the upload profile rather than left at the 10,000 GB default across the board, since scanning ceases once the threshold is exceeded. Sensitive data threat detection enabled, given it can be turned on at no additional cost.

  4. 4

    Build automated remediation through Event Grid

    A Function or Logic App connected to auto-delete, quarantine or alert on malicious blobs in near real time, with the quarantine location and retention decided. Then tested with a benign test file, because an untested response path is an assumption.

  5. 5

    Route alerts and prevent drift with policy

    Both scan cap alerts routed to a named owner, security alerts integrated with the team workflow, and Azure Policy configured to enforce enablement on new subscriptions so coverage keeps pace with the estate rather than lagging behind it.

Straight answers

What organisations ask about Defender for Storage.

Azure Blob Storage, Azure Files and Azure Data Lake Storage, by analysing data plane and control plane telemetry from those services. The features are activity monitoring, sensitive data threat detection, malware scanning and event driven response through Azure Event Grid.

No. Microsoft states you do not need to enable diagnostic logs for analysis, because the service continuously analyses the data and control telemetry stream directly. That removes a common prerequisite and a common source of cost in other monitoring approaches.

The cap. By default the limit is 10,000 GB of uploaded blobs per month per storage account, and once exceeded scanning ceases for the remaining blobs with a 20 GB confidence interval. Two alerts exist for this, one at 75 per cent of the cap and one when it is reached.

Yes. It can be set subscription wide, affecting all storage accounts in the subscription, or applied to individual accounts, and under protected subscriptions specific accounts can carry different limits. Sizing it per account against actual upload volume is the right approach.

No. Microsoft states it is a configurable feature you can enable or disable at no additional cost. It uses Sensitive Data Discovery, an agentless engine with smart sampling, and integrates with Purview sensitive information types and classification labels, so it inherits your existing sensitivity settings.

Malware scanning uses Microsoft Defender Antivirus for a deep file scan and incorporates hash reputation analysis, and is a paid feature available only on the new plan. Hash reputation analysis alone compares hashes against known malware and is available in all plans, but only catches malware that is already known.

Yes, and they are documented. Not all file protocols and operation types are supported. Unsupported use cases include SMB file shares, and blobs created using Put Block and Put Block List. If you are relying on it for file shares, it is not covering them.

By default you get an alert. To get an action, you configure event driven response through Azure Event Grid, connecting Azure Functions or Logic Apps to auto-delete, quarantine or send alerts for malicious blobs in near real time. That step is what makes detection into remediation.

Subscription level, which Microsoft recommends to help ensure comprehensive coverage. All existing and newly created storage accounts are then automatically included, and you can still exclude specific accounts or override settings for individual ones where there is a genuine reason.

Microsoft states activity monitoring does not affect performance, ingestion capacity or data access. Malware scanning does introduce additional Azure charges through storage read operations, blob indexing and Event Grid notifications, which is a cost consideration rather than a performance one.

Defender for Storage detects suspicious activities from entities without identities that access your data using misconfigured and overly permissive shared access signatures, which may have been leaked or compromised. In estates where SAS tokens are handed out freely, this frequently finds something real.

Yes. Microsoft states that if you have Defender for Storage classic enabled and want access to the current security features and pricing, you need to migrate to the new pricing plan. Malware scanning in particular is available only on the new plan.

Azure Policy, which can automatically enforce enablement on new subscriptions and help prevent configuration drift. Without it, every new subscription is a coverage gap until somebody notices, and in a growing estate somebody frequently does not.

Infrastructure as code is supported through Terraform, Bicep and ARM templates, and PowerShell can enable it across multiple subscriptions with a script. For organisations already managing Azure as code, that is a better route than portal configuration that later drifts.

We scope by the number of subscriptions and storage accounts. The free first step: check whether any storage account is exceeding the 10,000 GB default scan cap in a typical month. If one is, your protection is lapsing part way through every month and nobody has been told.

Yes, and for an Azure estate managed that way it is the better route. Enablement is supported through Terraform, Bicep and ARM templates, and PowerShell can enable it across multiple subscriptions with a script. Azure Policy then keeps new subscriptions enrolled automatically.

Yes, and that is one of its stronger cases. Security alerts cover the top cloud storage threats including sensitive data exfiltration, data corruption and malicious file uploads, using threat intelligence, behavioural models and machine learning models to detect unusual and suspicious activity.

Microsoft Threat Intelligence identifies suspicious signatures such as malicious IP addresses, Tor exit nodes and potentially dangerous apps, and statistical and machine learning methods spot anomalies against baseline activity. Microsoft also notes it avoids sending too many similar alerts for the same behaviour.

No, and that removes a common cost and configuration step. Microsoft states the service continuously analyses the data and control telemetry stream from Blob Storage, Files and Data Lake Storage, and that you do not need to enable diagnostic logs for analysis to work.

Microsoft states activity monitoring does not affect performance, ingestion capacity or data access. Malware scanning does introduce additional charges through storage read operations, blob indexing and Event Grid notifications, which is a cost consideration to model rather than a performance one.
Configuration review

Fifteen questions about your own storage protection.

The first group is where coverage is usually incomplete. The third is where detections either become actions or stay as notifications.

Coverage

  • Is the plan enabled at subscription level?
    Recommended for coverage.
  • Which accounts are excluded, and why?
    Exclusions should be justified.
  • Are we still on the classic plan?
    It needs migration.
  • Are Azure Files accounts covered?
    Not only blobs.
  • Does Azure Policy enforce new subscriptions?
    It prevents drift.

Scanning

  • What cap is set per storage account?
    Default is 10,000 GB monthly.
  • Which accounts exceed it?
    Scanning stops when they do.
  • Are the two cap alerts routed anywhere?
    75 per cent and reached.
  • Is sensitive data threat detection on?
    No additional cost.
  • Do we rely on hash reputation for file shares?
    SMB is unsupported there.

Response

  • Is Event Grid integration configured?
    For automated remediation.
  • What happens when malware is found?
    Delete, quarantine or alert.
  • Has the response been tested?
    With a benign test file.
  • Who receives the security alerts?
    A person, not a shared inbox.
  • Do we track additional Azure charges?
    Reads, indexing, Event Grid.
Related reading

The pages around this one.

Microsoft Defender for Cloud

The parent product and the wider workload protection plans.

Learn more

Cloud security posture audit

Assessing configuration across the cloud estate.

Learn more

Azure security audit

The wider review of an Azure environment.

Learn more
Next step

Check whether any storage account exceeds 10,000 GB of uploads in a typical month.

That is the default scan cap, and past it scanning stops for the rest of the month. If an account crosses it regularly, your protection has a monthly gap nobody was told about.

Book a storage protection reviewCall +971 56 613 2743

Related Services

Explore more solutions that work great with this service

Defender for Cloud

Azure posture, and the free tier almost nobody has enabled

Learn more

Cloud Security Posture Audit

The real inventory, then configuration and identity

Learn more

Azure Security Audit

Subscription audit, starting with the free tier you already own

Learn more

Defender for Servers

Plan 1 versus Plan 2, and the Azure Arc dependency

Learn more

AI Data Security Posture

Copilot readiness and control of shadow AI use

Learn more

Sensitivity Labels

Classification that travels with the file, and governs what Copilot sees

Learn more

Azure Key Vault

Secrets, keys and certificates out of config files

Learn more

Microsoft Security Dubai

Entra, Defender, Purview, Sentinel, and what you already own

Learn more
GR IT SERVICES

Leading IT services provider in Dubai,
delivering enterprise-grade solutions
for businesses across the UAE.

Microsoft CSP PartnerCISGuard

Get the Helpdesk app

Raise and track IT tickets from your phone.

Download on the App StoreGet it on Google Play
Learn more about the app

Microsoft 365

  • Microsoft 365 Administration
  • M365 Reporting & Auditing
  • Microsoft 365 Licensing
  • Microsoft Copilot
  • Microsoft 365 Apps
  • Windows 365 Cloud PC
  • Microsoft SharePoint
  • Outlook & Exchange

Security

  • Microsoft Defender
  • Microsoft Purview
  • Microsoft Intune
  • Microsoft Entra
  • Compliance Manager
  • Cybersecurity Audits
  • Copilot for Security
  • Microsoft Sentinel
  • Microsoft Priva

Infrastructure

  • Google Workspace
  • Cloud Migration Services
  • Data Analytics & BI
  • Active Directory
  • Server Management
  • Apple Business
  • Apple Jamf Pro
  • IP Telephone
  • Data Backup
  • Website Development

IT Services

  • Managed IT Services
  • IT Support Dubai
  • IT AMC Dubai
  • New Office IT Setup
  • IT Relocation
  • Remote IT Support
  • On-Call IT Support
  • Startup IT Business Kit
  • Disaster Recovery & BC

Company

  • About Us
  • Careers
  • Contact
  • Blog

Contact

  • Iris Bay Tower, Office 903,
    Business Bay, Dubai, UAE
  • +971 56 613 2743
  • hello@gritservices.ae
  • gritservices.ae

© 2026 GR IT Services. All rights reserved.

Privacy PolicyTerms of UseCookie Policy