Microsoft Defender

Microsoft Defender Scan API

The Scan API from Microsoft Defender — 3 operation(s) for scan.

GitHub OpenAPI

Operations 3

POST /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/startMalwareScan Defender for storage start malware scan #
POST /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/malwareScans/{scanId}/cancelMalwareScan Defender for storage cancel malware scan #
GET /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/malwareScans/{scanId} Defender for storage get malware scan #

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/rest/api/defenderforcloud/
📖
GettingStarted
https://learn.microsoft.com/en-us/azure/defender-for-cloud/get-started

Specifications

⚙
OpenAPI
https://artifacts.apis.io/microsoft-defender/openapi/microsoft-defender-scan-api-openapi.yml

Other Resources

🔗
Pricing
https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/
🔗
ReleaseNotes
https://learn.microsoft.com/en-us/azure/defender-for-cloud/release-notes

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/microsoft-defender:microsoft-defender-scan-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

microsoft-defender-scan-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Microsoft Defender for Cloud REST API (Microsoft.Security)…
  version: stable-composite
  description: Composite of the latest stable Microsoft.Security resource-manager swagger files published by Microsoft in Azure/azure-rest-api-specs. Each path keeps its own api-version via x-source.
  x-source-repo: https://github.com/Azure/azure-rest-api-specs/tree/main/specification/security/resource-manager/Microsoft.Security/Security
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: Scan
paths:
  /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/startMalwareScan:
    post:
      x-ms-examples:
        Initiate a Defender for Storage malware scan for the specified storage account.:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/examples/DefenderForStorage/StartMalwareScan_example.json
      tags:
      - Scan
      description: Initiate a Defender for Storage malware scan for the specified storage account.
      operationId: DefenderForStorage_StartMalwareScan
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/ResourceId
      - $ref: '#/components/parameters/DefenderForStorageSettingName'
      responses:
        '200':
          description: The status of the malware scan operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareScan'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/defenderForStorageSettings.json
      summary: Defender for storage start malware scan
      x-summary-source: derived
  ? /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/malwareScans/{scanId}/cancelMalwareScan
  : post:
      x-ms-examples:
        Cancel a Defender for Storage malware scan for the specified storage resource.:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/examples/DefenderForStorage/CancelMalwareScan_example.json
      tags:
      - Scan
      description: Cancels a Defender for Storage malware scan for the specified storage account.
      operationId: DefenderForStorage_CancelMalwareScan
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/ResourceId
      - $ref: '#/components/parameters/DefenderForStorageSettingName'
      - $ref: '#/components/parameters/ScanId'
      responses:
        '200':
          description: The status of the malware scan operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareScan'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/defenderForStorageSettings.json
      summary: Defender for storage cancel malware scan
      x-summary-source: derived
  /{resourceId}/providers/Microsoft.Security/defenderForStorageSettings/{settingName}/malwareScans/{scanId}:
    get:
      x-ms-examples:
        Gets the Defender for Storage malware scan for the specified storage resource.:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/examples/DefenderForStorage/GetMalwareScan_example.json
      tags:
      - Scan
      description: Gets the Defender for Storage malware scan for the specified storage resource.
      operationId: DefenderForStorage_GetMalwareScan
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/ResourceId
      - $ref: '#/components/parameters/DefenderForStorageSettingName'
      - $ref: '#/components/parameters/ScanId'
      responses:
        '200':
          description: The state of the malware scan operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareScan'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2025-06-01/defenderForStorageSettings.json
      summary: Defender for storage get malware scan
      x-summary-source: derived
components:
  schemas:
    ScanSummary:
      type: object
      description: A summary of the scan results.
      properties:
        blobs:
          type: object
          $ref: '#/components/schemas/BlobsScanSummary'
          description: A summary of the scan results of the blobs that were scanned.
        estimatedScanCostUSD:
          type: number
          format: double
          description: The estimated cost of the scan. Only available for a scan which has terminated.
    MalwareScanProperties:
      type: object
      properties:
        scanId:
          type: string
          description: The identifier of the scan.
        scanStatus:
          type: string
          description: A status code of the scan operation.
        scanStatusMessage:
          type: string
          description: A description of the status of the scan.
        scanStartTime:
          type: string
          description: The time at which the scan had been initiated.
        scanEndTime:
          type: string
          description: The time at which the scan has ended. Only available for a scan which has terminated.
        scanSummary:
          type: object
          $ref: '#/components/schemas/ScanSummary'
          description: A summary of the scan results.
    MalwareScan:
      type: object
      properties:
        properties:
          $ref: '#/components/schemas/MalwareScanProperties'
      description: Describes the state of a malware scan operation.
    BlobsScanSummary:
      type: object
      description: A summary of the scan results of the blobs that were scanned.
      properties:
        totalBlobsScanned:
          type: integer
          format: int64
          description: The total number of blobs that were scanned.
        maliciousBlobsCount:
          type: integer
          format: int64
          description: The number of malicious blobs that were detected during the scan.
        skippedBlobsCount:
          type: integer
          format: int64
          description: The number of blobs that were skipped.
        failedBlobsCount:
          type: integer
          format: int64
          description: The number of failed blob scans.
        scannedBlobsInGB:
          type: number
          format: double
          description: The number of gigabytes of data that were scanned.
  parameters:
    ScanId:
      name: scanId
      in: path
      required: true
      description: The identifier of the scan. Can be either 'latest' or a GUID.
      x-ms-parameter-location: method
      schema:
        type: string
        pattern: ^(latest|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$
    DefenderForStorageSettingName:
      name: settingName
      in: path
      required: true
      x-ms-enum:
        name: settingName
        modelAsString: true
        values:
        - value: current
          description: Name of the Defender for Storage Settings name.
      description: Defender for Storage setting name.
      x-ms-parameter-location: method
      schema:
        type: string
        enum:
        - current
        pattern: ^[a-z][a-z0-9]*$
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.