Do not use editable blob scan tags as the sole release control

Source facts

Defender for Storage can write scan outcomes and scan time into blob index tags. These tags are editable by identities with tag-modification permission, so Microsoft warns against using them as the only security control. It recommends alerts, Event Grid events or Log Analytics for security-sensitive workflows. Microsoft Learn.

Scanning does not itself interrupt an application’s access to the blob, and scan duration varies. Event Grid result delivery needs additional configuration and does not support topics with public network access disabled. Optional Log Analytics collection records scan results in StorageMalwareScanningResults. Microsoft Learn.

Applicability

Use this design review for applications consuming Defender for Storage malware scan results for Azure blobs. Review the source’s supported content and storage configuration before relying on scanning. A display tag should not silently become the authority for distributing uploaded content.

DSE recommendation

DSE recommends documenting the exact event or record that permits downstream release. Separate an affirmative scan result from missing, failed or unfinished processing, and define who resolves each exception. Review the permissions of identities that can modify blob tags. Choose a result-delivery route compatible with the approved network design rather than weakening that design merely to obtain notifications.

Verification

In an isolated test workflow, compare the authoritative scan result with the blob’s displayed tags and the application’s release decision. Include delayed and unsuccessful processing cases. Confirm that changing a tag alone cannot authorize release. Retain the input identity, result evidence and downstream decision without claiming that an undetected file is guaranteed harmless.

Official references

Microsoft Learn: Introduction to malware scanning.