Microsoft Defender Defender For Storage API

openapi: 3.2.0
info:
  title: Microsoft Defender for Cloud REST API (Microsoft.Security)…
  version: stable-composite
  description: Composite of the latest stable Microsoft.Security resource-manager swagger files published by Microsoft in Azure/azure-rest-api-specs. Each path keeps its own api-version via x-source.
  x-source-repo: https://github.com/Azure/azure-rest-api-specs/tree/main/specification/security/resource-manager/Microsoft.Security/Security
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: DefenderForStorage
paths:
  /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}:
    get:
      x-ms-examples:
        Gets the Defender for Storage settings for the specified resource.:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/examples/DefenderForStorage/GetDefenderForStorageSettings_example.json
      tags:
      - DefenderForStorage
      description: Gets the Defender for Storage settings for the specified storage account.
      operationId: DefenderForStorage_Get
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/ResourceId
      - $ref: '#/components/parameters/DefenderForStorageSettingName'
      responses:
        '200':
          description: Successful request to get Defender for Storage settings.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefenderForStorageSetting'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/defenderForStorageSettings.json
      summary: Defender for storage get
      x-summary-source: derived
    put:
      x-ms-examples:
        Creates or updates the Defender for Storage settings on a specified resource.:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/examples/DefenderForStorage/PutDefenderForStorageSettings_example.json
      tags:
      - DefenderForStorage
      description: Creates or updates the Defender for Storage settings on a specified storage account.
      operationId: DefenderForStorage_Create
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/ResourceId
      - $ref: '#/components/parameters/DefenderForStorageSettingName'
      - $ref: '#/components/parameters/DefenderForStorageSetting'
      responses:
        '200':
          description: Successful request to create or update Defender for Storage settings.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefenderForStorageSetting'
        '201':
          description: Request to  create or update Defender for Storage settings partially succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DefenderForStorageSetting'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/defenderForStorageSettings.json
      summary: Defender for storage create
      x-summary-source: derived
  /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/startMalwareScan:
    post:
      x-ms-examples:
        Initiate a Defender for Storage malware scan for the specified storage account.:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/examples/DefenderForStorage/StartMalwareScan_example.json
      tags:
      - DefenderForStorage
      description: Initiate a Defender for Storage malware scan for the specified storage account.
      operationId: DefenderForStorage_StartMalwareScan
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/ResourceId
      - $ref: '#/components/parameters/DefenderForStorageSettingName'
      responses:
        '200':
          description: The status of the malware scan operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareScan'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/defenderForStorageSettings.json
      summary: Defender for storage start malware scan
      x-summary-source: derived
  ? /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/malwareScans/{scanId}/cancelMalwareScan
  : post:
      x-ms-examples:
        Cancel a Defender for Storage malware scan for the specified storage resource.:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/examples/DefenderForStorage/CancelMalwareScan_example.json
      tags:
      - DefenderForStorage
      description: Cancels a Defender for Storage malware scan for the specified storage account.
      operationId: DefenderForStorage_CancelMalwareScan
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/ResourceId
      - $ref: '#/components/parameters/DefenderForStorageSettingName'
      - $ref: '#/components/parameters/ScanId'
      responses:
        '200':
          description: The status of the malware scan operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareScan'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/defenderForStorageSettings.json
      summary: Defender for storage cancel malware scan
      x-summary-source: derived
  /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/malwareScans/{scanId}:
    get:
      x-ms-examples:
        Gets the Defender for Storage malware scan for the specified storage resource.:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/examples/DefenderForStorage/GetMalwareScan_example.json
      tags:
      - DefenderForStorage
      description: Gets the Defender for Storage malware scan for the specified storage resource.
      operationId: DefenderForStorage_GetMalwareScan
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/ResourceId
      - $ref: '#/components/parameters/DefenderForStorageSettingName'
      - $ref: '#/components/parameters/ScanId'
      responses:
        '200':
          description: The state of the malware scan operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareScan'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/defenderForStorageSettings.json
      summary: Defender for storage get malware scan
      x-summary-source: derived
components:
  schemas:
    OperationStatus:
      type: object
      description: A status describing the success/failure of the enablement/disablement operation.
      properties:
        code:
          type: string
          description: The operation status code.
        message:
          type: string
          description: Additional information regarding the success/failure of the operation.
    ScanSummary:
      type: object
      description: A summary of the scan results.
      properties:
        blobs:
          type: object
          $ref: '#/components/schemas/BlobsScanSummary'
          description: A summary of the scan results of the blobs that were scanned.
        estimatedScanCostUSD:
          type: number
          format: double
          description: The estimated cost of the scan. Only available for a scan which has terminated.
    DefenderForStorageSettingProperties:
      type: object
      properties:
        isEnabled:
          type: boolean
          description: Indicates whether Defender for Storage is enabled on this storage account.
        malwareScanning:
          $ref: '#/components/schemas/MalwareScanningProperties'
        sensitiveDataDiscovery:
          $ref: '#/components/schemas/SensitiveDataDiscoveryProperties'
        overrideSubscriptionLevelSettings:
          type: boolean
          description: Indicates whether the settings defined for this storage account should override the settings defined for the subscription.
      description: Defender for Storage resource properties.
    SensitiveDataDiscoveryProperties:
      type: object
      properties:
        isEnabled:
          type: boolean
          description: Indicates whether Sensitive Data Discovery should be enabled.
        operationStatus:
          type: object
          $ref: '#/components/schemas/OperationStatus'
          readOnly: true
          description: Upon failure or partial success. Additional data describing Sensitive Data Discovery enable/disable operation.
      description: Properties of Sensitive Data Discovery.
    DefenderForStorageSetting:
      type: object
      allOf:
      - $ref: ./common/v1/types.json#/definitions/Resource
      properties:
        properties:
          $ref: '#/components/schemas/DefenderForStorageSettingProperties'
      description: The Defender for Storage resource.
    MalwareScanningProperties:
      type: object
      properties:
        onUpload:
          $ref: '#/components/schemas/OnUploadProperties'
        scanResultsEventGridTopicResourceId:
          type: string
          description: Optional. Resource id of an Event Grid Topic to send scan results to.
        blobScanResultsOptions:
          type: string
          description: Optional. Write scan result on blobIndexTags by default.
          enum:
          - blobIndexTags
          - None
          x-ms-enum:
            name: blobScanResultsOptions
            modelAsString: true
            values:
            - value: blobIndexTags
              description: Write scan results on the blobs index tags.
            - value: None
              description: Do not write scan results on the blobs index tags.
        operationStatus:
          type: object
          $ref: '#/components/schemas/OperationStatus'
          readOnly: true
          description: Upon failure or partial success. Additional data describing Malware Scanning enable/disable operation.
      description: Properties of Malware Scanning.
    MalwareScanProperties:
      type: object
      properties:
        scanId:
          type: string
          description: The identifier of the scan.
        scanStatus:
          type: string
          description: A status code of the scan operation.
        scanStatusMessage:
          type: string
          description: A description of the status of the scan.
        scanStartTime:
          type: string
          description: The time at which the scan had been initiated.
        scanEndTime:
          type: string
          description: The time at which the scan has ended. Only available for a scan which has terminated.
        scanSummary:
          type: object
          $ref: '#/components/schemas/ScanSummary'
          description: A summary of the scan results.
    OnUploadFilters:
      type: object
      properties:
        excludeBlobsWithPrefix:
          type:
          - array
          - 'null'
          items:
            type: string
          description: 'Optional. A list of prefixes to exclude from on-upload malware scanning.

            Format: `container-name/blob-name` (start with the container name; do not include the storage account name).

            Exclude entire containers: Use prefix of container names you want to exclude without a trailing `/`.

            Exclude a single container: Add a trailing slash `/` after the container name to avoid excluding other containers with similar prefixes.'
        excludeBlobsWithSuffix:
          type:
          - array
          - 'null'
          items:
            type: string
          description: Optional. A list of suffixes to exclude from on-upload malware scanning. Suffixes match only the end of blob names, and should be used for file extensions or blob name endings only.
        excludeBlobsLargerThan:
          format: int64
          description: Optional. Specifies the maximum size in bytes for blobs to be scanned. This parameter accepts a single positive integer value. Blobs larger than this value will be excluded from scanning.
      description: Optional. Determine which blobs get scanned by On Upload malware scanning. An Or operation is performed between each filter type.
    MalwareScan:
      type: object
      properties:
        properties:
          $ref: '#/components/schemas/MalwareScanProperties'
      description: Describes the state of a malware scan operation.
    BlobsScanSummary:
      type: object
      description: A summary of the scan results of the blobs that were scanned.
      properties:
        totalBlobsScanned:
          type: integer
          format: int64
          description: The total number of blobs that were scanned.
        maliciousBlobsCount:
          type: integer
          format: int64
          description: The number of malicious blobs that were detected during the scan.
        skippedBlobsCount:
          type: integer
          format: int64
          description: The number of blobs that were skipped.
        failedBlobsCount:
          type: integer
          format: int64
          description: The number of failed blob scans.
        scannedBlobsInGB:
          type: number
          format: double
          description: The number of gigabytes of data that were scanned.
    OnUploadProperties:
      type: object
      properties:
        isEnabled:
          type: boolean
          description: Indicates whether On Upload malware scanning should be enabled.
        capGBPerMonth:
          type: integer
          format: int32
          description: Defines the max GB to be scanned per Month. Set to -1 if no capping is needed. If not specified, the default value is -1.
        filters:
          $ref: '#/components/schemas/OnUploadFilters'
          description: Optional. Determine which blobs get scanned by On Upload malware scanning. An Or operation is performed between each filter type.
      description: Properties of On Upload malware scanning.
  parameters:
    ScanId:
      name: scanId
      in: path
      required: true
      description: The identifier of the scan. Can be either 'latest' or a GUID.
      x-ms-parameter-location: method
      schema:
        type: string
        pattern: ^(latest|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$
    DefenderForStorageSetting:
      name: defenderForStorageSetting
      in: body
      required: true
      description: Defender for Storage Settings
      schema:
        $ref: '#/components/schemas/DefenderForStorageSetting'
      x-ms-parameter-location: method
    DefenderForStorageSettingName:
      name: settingName
      in: path
      required: true
      x-ms-enum:
        name: settingName
        modelAsString: true
        values:
        - value: current
          description: Name of the Defender for Storage Settings name.
      description: Defender for Storage setting name.
      x-ms-parameter-location: method
      schema:
        type: string
        enum:
        - current
        pattern: ^[a-z][a-z0-9]*$
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.