microsoft/TechLab-Module-19-Defender-for-Storage

microsoft/TechLab-Module-19-Defender-for-Storage

License: MIT

Stars: 0

Forks: 1

Open issues: 1

Created: 2026-06-25T19:41:12Z

Pushed: 2026-06-25T19:46:33Z

Default branch: main

Fork: no

Archived: no

README: @lab.Title

Please enter your own Microsoft alias (without the @microsoft.com) in the field below before starting the lab. This information is required to correctly associate your activity with your learner record and ensure your completion is accurately captured and reported. For data integrity and compliance reasons, learners may only enter their own alias. After completing the lab, please allow up to 5 business days for all reporting systems to fully reflect your completion.

@lab.ActivityGroup(aliascapture)

===

Survey

@lab.ActivityGroup(initialsurvey)

===

Objectives

In these exercises, you will learn how to enable Defender for Storage and leverage its capabilities.

Table of Contents

• Task 01: Prepare the environment for a Defender for Storage Plan.
• Task 02: Upload malware to a Storage Account.
• Task 03: Security alert.
• Task 04: Configure automation to delete the malicious file.
• Task 05: Code to upload files to a storage account and monitor the Blob Index tag.
• Task 06: Set up "Send Scan Results to Log Analytics" and Read It.
• Task 07: Function App based on Grid Events.
• Task 08: ABAC for users not to read malicious files.
• Task 09: Configure and Test On-Demand Malware Scanning.
• Task 10: Observe results in Log Analytics.
• Task 11: Test on-demand malware scanning.
• Task 12: Test on-demand scanning via API.

---

⌛ Estimated time to complete this lab: 60 minutes

===

Using this Lab

>[!hint] Copy Text Supported > > The fill in fields of this simulation require the exact text be entered to progress. To make that easier, you can select ++Copy Text++ options in the instructions pane to copy directly into your simulation text entry fields.

---

###Images and diagrams

All images and diagrams in the lab instructions are selectable. Selecting any image opens a zoomed view in a separate window for better clarity and analysis.

---

###Split Window feature

If you're equipped with multiple screens, you can use the Split Window feature to place the lab instructions on a separate screen, making better use of your screen real estate.

To enable this feature:

1. Go to the gear icon in the upper-right corner of the instructions pane.

1. On the lower side of the Settings pane, select Split Windows.


===

Task 01: Preparing the environment for a Defender for Storage plan

1. In the Azure portal dashboard select Microsoft Defender for Cloud.


1. In the left side pane, select Management, then Environment settings.

1. On the lower side of the page, select Expand all.


1. Select the TechMaster-lod52451385 subscription.


1. Under the Cloud Workload Protection (CWPP) section, turn on Storage.


1. Under the Monitoring coverage column, select Settings.


1. On the Malware scanning line, under Configuration, select Edit configuration.

1. In the flyout pane, select Soft delete malicious blobs, then select Apply.


1. In the upper-left corner of the page, select Continue.


1. At the top of the page, select Save.


---

Now all your existing and upcoming Azure Storage Accounts are protected.

===

Task 02: Upload sample malware to a storage account

A sample malicious test file (EICAR) has already been added to your lab VM for testing purposes. Your lab was also predeployed with a storage account and a log analytics workspace.

>[!knowledge] By default, when you create a storage account, you get the User Access Administrator and Service Administrator roles. To enable and configure malware scanning, you must have Owner roles (such as Subscription Owner or Storage Account Owner) or specific roles with the necessary data actions. > >Learn more about the **required permissions**.

1. In Azure's search bar, type ++defsto61155713++, press Enter, then select the storage account.

1. In the storage account's left side pane, select Data storage, then Containers.

1. On the top bar, select Upload .

1. In the flyout pane:

1. Select Browse for files.

1. From C:\Lab Files, select eicar, then select Open.


1. In the Select an existing container dropdown menu, select contosofinance.


1. Select Upload.

1. Select the contosofinance container.

1. Above the table, select the right side dropdown menu, then select Show active and deleted blobs.


1. Select the eicar.com file you uploaded, which was automatically detected and deleted. Observe the results.

1. Explore the other two tabs, Versions and Snapshots.


===

Task 03: Assign your user account IAM role

A later task will require the Storage Blob Data Owner role. Let's set that up while you're here.

1. In the upper-left corner of the page, select the defsto61155713 | Containers breadcrumb link.


1. In the storage account's left side pane, select Access Control (IAM).

1. Select Add role assignment.


1. In the search box above the table, type ++Storage Blob Data Owner++ and press Enter, then select the result in the list.


1. On the lower part of the page, select Next.

1. On the line for Members, choose Select members.

1. In the flyout pane:

1. Type the user and press Enter:

++User1-61155713@LODSPRODMCA.onmicrosoft.com++

1. Choose Select.


1. On the lower side of the page, select...