Microsoft Defender for Storage should be enabled

What does the recommendation "Microsoft Defender for Storage should be enabled" check?

Flags any subscription or storage account where the Microsoft Defender for Storage plan is not turned on. It checks that the Defender for Cloud 'StorageAccounts' pricing plan is set to the Standard tier, the layer that provides threat detection across Blob Storage, Azure Files and Data Lake Storage Gen2. It does not verify that the optional malware scanning or sensitive data threat detection sub-features are configured, so a subscription can pass this control with only the baseline activity monitoring enabled. It also does not inspect your network rules, access keys, public access setting or encryption, those are separate controls; this one is purely about whether the detection plane exists.

Why does "Microsoft Defender for Storage should be enabled" matter?

Storage accounts are a prime target: attackers upload malware for others to download, exfiltrate data using stolen account keys or over-permissive SAS tokens, and probe for anonymous or anonymously listable containers. Without Defender for Storage you have no threat detection on any of that activity, so a compromised key or a poisoned upload goes unnoticed until the damage is already done and the data is gone. The plan raises near real-time security alerts on suspicious access patterns, access from known-malicious IP addresses and unusual data extraction, and the malware scanning feature can inspect blobs at upload time before a downstream consumer ever fetches them. Leaving it off means a longer attacker dwell time and a breach you typically learn about from a customer, a regulator or a third-party researcher rather than from your own monitoring, which is both the slower and the more expensive way to find out.

How do I fix "Microsoft Defender for Storage should be enabled"?

1. Enable the plan at the subscription level so new accounts are covered automatically: 'az security pricing create -n StorageAccounts --tier Standard --subplan DefenderForStorageV2'. This is cheaper and safer than enabling per account because it scales as the estate grows.
2. Decide whether to turn on the configurable features: malware scanning (set a per-account monthly GB cap to control cost) and sensitive data threat detection. Both add real protection but bill per scan, so size the cap to your upload volume rather than leaving the 10,000 GB default unconsidered.
3. Enforce it going forward with the built-in Azure Policy 'Configure Microsoft Defender for Storage to be enabled' (DeployIfNotExists) assigned at the management group, so any new subscription inherits the plan instead of relying on someone remembering.

# Enable the three high-value Defender plans on the current subscription.
# Servers on Plan 2 (adds JIT access, FIM and vulnerability scanning).
az security pricing create --name VirtualMachines \
  --tier Standard --subplan P2

# Storage on the current per-account plan.
az security pricing create --name StorageAccounts --tier Standard

# Azure SQL Database servers (VA + Advanced Threat Protection).
az security pricing create --name SqlServers --tier Standard

# Verify what is now active on this subscription.
az security pricing list \
  --query "value[?pricingTier=='Standard'].name" -o tsv

# Ratchet it shut for the estate: assign the built-in DeployIfNotExists
# policies that turn each plan on for any subscription where it is missing.
# Servers (built-in 'Configure Azure Defender for servers to be enabled').
az policy assignment create \
  --name enable-defender-servers \
  --policy 8e86a5b6-b9bd-49d1-8e21-4bb8a0862222 \
  --scope "/providers/Microsoft.Management/managementGroups/contoso-root"

# Look up the matching Storage and SQL policies by display name rather than
# hard-coding a GUID, then assign each the same way at the same scope.
az policy definition list \
  --query "[?contains(displayName, 'Configure Microsoft Defender for Storage') || contains(displayName, 'Configure Azure Defender to be enabled on SQL servers')].{name:name, displayName:displayName}" \
  -o table