Triggering Automated Responses from Defender for Storage
You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has on-upload malware scanning enabled. The security team at your company requires that all malicious files be processed automatically by a serverless workflow for quarantine and notification. You need to ensure that the malware scan results trigger an automated response. The solution must minimize operational effort. What should you configure?
Community Insight
The key is recognizing that Defender for Storage publishes real-time security events to Event Grid, which serves as the event bus for triggering Logic Apps or Functions.
This question tests how to trigger automated serverless workflows based on Microsoft Defender for Storage malware scan results. The correct solution uses Azure Event Grid to route events with minimal operational effort.
Many candidates choose Diagnostic Settings (B) because it is commonly used for log aggregation, but it introduces latency and higher operational overhead compared to Event Grid for real-time automation.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft Defender for Storage natively publishes detection events, including malware scan results, to Azure Event Grid. By configuring an Event Grid subscription, you can immediately route these events to serverless compute services like Azure Logic Apps or Azure Functions. This enables real-time processing for quarantine and notification tasks with minimal operational effort, aligning perfectly with the requirement.Why the Other Options Are Wrong
Diagnostic settings (Option B) send logs to destinations like Log Analytics or Event Hubs, but they are not designed for real-time event-driven automation; they introduce latency and require more complex logic to parse logs. Lifecycle management policies (Option C) are used for data tiering and expiration, not security response. Azure Monitor alert rules (Option D) are typically used for metrics and thresholds rather than discrete event-based workflows for individual file scans.Community Comment Notes
Community consensus strongly supports Option A, noting that "Microsoft Defender for Storage natively publishes real-time malware scan results directly to Azure Event Grid." One user highlighted that this approach allows routing to Logic Apps or Functions instantly. Another comment was irrelevant, discussing Virtual Network components, which does not apply to this storage security scenario.Official Reference
Exam Strategy
When asked about automating responses to security detections in Azure, always consider Event Grid first as the primary event routing mechanism for serverless triggers.
Frequently Asked Questions
Why not use Diagnostic Settings for real-time alerts?
Diagnostic settings are better for logging and long-term analysis. They do not provide the low-latency, event-driven architecture needed for immediate serverless automation.
Can Logic Apps be triggered by Defender for Storage?
Yes, but indirectly via Event Grid. You configure an Event Grid subscription to send the Defender event to a Logic App webhook or function app.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →