Facing cloud exception while enabling the defender for blob storage for malware scan.

Question

defendererror.png

Answer 1

Hi Garima,

I understand that you're encountering a cloud exception when trying to enable Defender for Blob Storage for malware scanning. This issue can be troubleshooted by following the steps below:

Unsupported features and services

• Unsupported storage accounts: Legacy v1 storage accounts aren't supported by malware scanning.
• Unsupported service: Azure Files isn't supported by malware scanning.
• Unsupported regions: Jio India West, Korea South, South Africa West.
• Regions that are supported by Defender for Storage but not by malware scanning. Learn more about availability for Defender for Storage.
• Unsupported blob types: Append and Page blobs aren't supported for Malware Scanning.
• Unsupported encryption: Client-side encrypted blobs aren't supported as they can't be decrypted before scanning by the service. However, data encrypted at rest by Customer Managed Key (CMK) is supported.
• Unsupported index tag results: Index tag scan result isn't supported in storage accounts with Hierarchical namespace enabled (Azure Data Lake Storage Gen2).
• Event Grid: Event Grid topics that don't have public network access enabled (i.e. private endpoint connections) are not supported by malware scanning in Defender for Storage.

For more detailed instructions, you can view solution:

• Limitations
• Limitations 2

Please let us know if any questions

Kindly accept answer if it helps

Thanks

Deepanshu

Answer 2

Hello Gupta, Garima,

Greetings! Welcome to Microsoft Q&A Platform.Adding to above information, please note that for Malware Scanning and sensitive data threat detection at subscription and storage account levels, you need Owner roles (subscription owner/storage account owner) or specific roles with corresponding data actions.

The following table summarizes the permissions you need for each scenario. The permissions are either built-in Azure roles or action sets that you can assign to custom roles.

Details on unsupported features and services in Malware Scanning: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-malware-scan#limitations

You can check if you file has any of these limitations.

For your use case with files <= 2GB, I would recommend using Azure Logic Apps for handling malware scan results and copying the blob to another storage account. Logic Apps provide a simple, no-code approach to setting up response, although the response time might be slower than the event-driven code-based approach. Please see Option 1: Logic App based on Microsoft Defender for Cloud security alerts for steps on configuring this, the default is delete but you can modify to move it.

Reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-malware-scan.

Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.