Question

A retail company operates a public-facing web application on Azure App Service that lets customers upload documents (invoices, receipts) into an Azure Blob Storage container. A downstream automated workflow processes each uploaded file. Security architects are concerned that attackers could upload malware that would later be executed or distributed through the processing pipeline. They want an Azure-native capability that automatically inspects uploaded content and can trigger a quarantine or block action before the file is processed, without requiring the developers to build a custom scanning service. Which solution should the architect recommend?

Accepted Answer

Enable Microsoft Defender for Storage with the malware scanning feature and use the scan-result event to gate downstream processing.

Answer

Deploy Microsoft Defender for Servers on the App Service plan and rely on its endpoint EDR to scan uploaded blobs.

Answer

Configure Azure Storage lifecycle management policies to automatically delete blobs older than 24 hours.

Answer

Enable Microsoft Defender External Attack Surface Management (EASM) to discover and scan the exposed storage endpoint.