3.1.2. Defender for Storage and Access Management
💡 First Principle: Preventive configuration on a storage account answers "what's allowed," but Defender for Storage answers a different question — "does this specific access pattern look like it belongs," which catches threats that technically satisfy every permission check you've configured.
Defender for Storage provides threat protection by analyzing access patterns and file activity — flagging things like malware uploads (via built-in malware scanning), unusual access from a Tor exit node or unfamiliar location, and anomalous data exfiltration volume. This complements, rather than replaces, access management — the ongoing discipline of reviewing who and what has access (RBAC role assignments, active SAS tokens, access policies) and removing what's no longer needed.
| Layer | Question It Answers |
|---|---|
| Firewall rules (3.1.1) | Can this network location reach the account at all? |
| Access management (RBAC, SAS scope) | Does this identity/credential have permission to act? |
| Defender for Storage | Does this permitted action still look suspicious? |
⚠️ Exam Trap: Defender for Storage alerting on a malware upload doesn't mean the account's access controls failed — a legitimately-authorized user or application can still upload malicious content. Detection and prevention are separate layers on purpose; don't treat a Defender alert as evidence that RBAC or firewall configuration needs to change unless the access itself was also unauthorized.
Reflection Question: An authorized service account uploads a file that Defender for Storage flags as malware. What does that tell you about the account's access configuration, and what does it not tell you?
