Back to Checks
azure

Defender for Storage is set to On (Standard pricing tier)

defender_ensure_defender_for_storage_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:microsoft.security/pricings

Azure subscription's Defender for Storage plan is set to Standard for Storage Accounts.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender for Storage, suspicious access to blobs, files, and queues may go undetected. Compromised keys or SAS tokens can enable data exfiltration (confidentiality), object tampering (integrity), and mass deletion or ransomware-like encryption (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_storage_is_on

Recommendation

Enable Defender for Storage at the Standard tier for subscriptions with storage workloads. Apply defense in depth: restrict network exposure, enforce least privilege on keys and SAS, use short-lived tokens and rotation, and route alerts to centralized monitoring for rapid response.

Remediation

CLI

az security pricing create -n StorageAccounts --tier Standard

Terraform

# Enable Microsoft Defender for Storage at subscription level
resource "azurerm_security_center_subscription_pricing" "example_resource_name" {
  resource_type = "StorageAccounts"
  tier          = "Standard" # CRITICAL: sets Storage plan to Standard (ON)
}

NativeIaC

// Enable Microsoft Defender for Storage at subscription level
resource example_resource_name 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'StorageAccounts'
  properties: {
    pricingTier: 'Standard' // CRITICAL: sets the plan to Standard (ON) for Storage
  }
}

Other

1In Azure portal, open Microsoft Defender for Cloud
2Go to Environment settings > select <subscription>
3Open Defender plans
4Set Storage to On (Standard)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_storage_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "StorageAccounts" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=pricings["StorageAccounts"],
                )
                report.subscription = subscription
                report.resource_name = "Defender plan Storage Accounts"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for Storage Accounts from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["StorageAccounts"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for Storage Accounts from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References