Azure File Sync - Windows Defender recalling files (Cloud Tiering)

Tommy Newman 16

The Windows Defender Anti-Virus “MsMpEng.exe” has recalled files from cloud “Azure storage accounts” to the local Windows Servers. From 9 AM to 9 PM on the 4th of April, it recalled around 2TB. I thought Defender would not go and pull files down from the cloud like this, as we had an issue in which the sync drive for Azure file sync ended up being full. I thought the policy set of keeping 20% space would have prevented this? 2023-04-08 10_39_56-Azure File Server Disk Space Incident 5th April 2023.docx - Word

https://success.trendmicro.com/IdeasExchange/IDEA-00004858 FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS Microsoft's in-house antivirus solutions, Windows Defender and System Center Endpoint Protection (SCEP), both automatically skip reading files that have this attribute set.

Sumarigo-MSFT 43,486 Reputation points Microsoft Employee

2023-04-11T11:30:58.8833333+00:00

@Tommy Newman Firstly, apologies for the delay in responding here and any inconvenience this issue may have caused. I am looking into this thread!
Tommy Newman 16 Reputation points

2023-04-11T11:38:33.05+00:00

Thank you. At the time of myself investing this issue we were running something called a Varonis file walk. The file walk itself only looks at the meta data of the stub / tiering files, it appears Windows Defender is causing the files to be recalled from what I can see.
Sumarigo-MSFT 43,486 Reputation points Microsoft Employee

2023-04-12T06:15:19.9666667+00:00

@Tommy Newman I wish to engage with you offline for a closer look and provide a quick and specialized assistance, please send an email with subject line “Attn:subm” to AzCommunity@Microsoft.com referencing this thread . Can you share Server ID, Subscription details and volume GUID so that we can investigate?

Thanks for your patience and co-operation.
Tommy Newman 16 Reputation points

2023-04-12T09:20:07.0633333+00:00

Hi Sumarigo, thanks for your support. We are looking to arrange a controlled test so we can get some more logs and troubleshoot the issue. I can let you know what we find via this channel when we have done so.
Leif Johansson 26 Reputation points

2023-08-31T10:22:14.7833333+00:00

Any update on this?

We have the same problem.
Tommy Newman 16 Reputation points

2023-08-31T10:40:21.4+00:00

Is this using Varonis as well?