list of all storage accounts which have "Defender for storage" enabled (using e.g. Azure CLI / PS / KQL)

Question

Hi all,

Microsoft allows to granularly enable "Defender for storage" (which is great! - link) . Unfortunately there is no one place in Azure Portal when you can see such of Storage account.

Do you know how "programmatically" list of all Storage accounts which have "Defender for storage enabled"?

It can by KQL / Azure CLI / PS but I need one command which will list it. ( so commands like "Get-AzSecurityAdvancedThreatProtection" , "az security atp storage" do not work)

.... or maybe there is some view in Azure Portal? (in Defender for Cloud is presented like "off" if you enable this per storage)

Thank you in advance for your help

Answer 1

@Bart Olejnik

You can use the below CLI script to loop through the Storage Accounts. This should return the information required.

# Get a list of all storage accounts in the subscription
storage_accounts=$(az storage account list --query "[].{resourceGroup:resourceGroup, name:name}" --output tsv)

# Loop through the storage accounts and run the az security atp storage show command
while read -r resource_group name; do
  echo "Storage Account: $name"
  az security atp storage show --resource-group "$resource_group" --storage-account "$name"
  echo
done <<< "$storage_accounts"

---

If you still have questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts.

If the answer has been helpful, we appreciate hearing from you and would love to help others who may have the same question. Accepting answers helps increase visibility of this question for other members of the Microsoft Q&A community.

Thank you for helping to improve Microsoft Q&A!