Defender for storage is able to scan the password protected PDF files, is that expected behaviour?

Hello Min,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. 

To clarify your doubt, this behavior is a feature, not a bug. Defender for Storage on-upload malware scanning can, under specific circumstances, scan password-protected PDF files, while other file types like Word and Zip fail as expected. This is because of differences in how various file formats handle encryption and metadata.

Technically, the issue lies in the distinction between file level encryption and the way password protection is implemented in different file formats.

Microsoft Office and ZIP/RAR files typically use strong, file-level encryption that makes the file's content unreadable without the password. The on-upload malware scanner, being an external, cloud-native service, cannot decrypt this content, so the scan fails as documented.

PDF files can be password protected in two ways:

1. Open Password: This requires a password to open the file.
2. Permissions Password: This allows anyone to open the file but restricts actions like printing, copying, or editing. While both methods use encryption, the metadata and file structure of many PDF documents remain accessible even with an open password. Defender for Storage's malware scanner, which uses Microsoft Defender Antivirus engines, may be able to scan this non-encrypted metadata and certain parts of the file stream to detect malicious code, even if the primary content is protected. This is why the scan may report success while other file types fail.

So, to handle a situation where a password-protected PDF should be considered a security risk and flagged as such, you should implement additional measures using Azure Policy and Azure Functions.

Create a Logic App or Azure Function: You can use a blob trigger in an Azure Function or Logic App that runs whenever a new file is uploaded to the storage account.

Check the File Type: The function can inspect the file's metadata to check if it is a PDF.

Check File Status: If the file is a PDF, the function can check if it has a password using a third-party library or a dedicated script.

Create an Alert: If the file is a password-protected PDF, the function can then trigger a custom alert in Microsoft Defender for Cloud or send a notification to a security team for manual review.

Please refer below documents for better understanding:

https://learn.microsoft.com/en-us/azure/defender-for-cloud/introduction-malware-scanning

https://learn.microsoft.com/en-us/azure/defender-for-cloud/on-demand-malware-scanning

Hope this clarify your doubt.
Kindly let us know if the above helps or you need further assistance on this issue. 

Please "Accept the answer" if the information helped you and 'upvote' for it. This will help us and others in the community as well. Happy to help!

Regards,

Monalisha

Hi Monalisha,

Thanks for your reply, for PDF files with "Open Password", should the defender for cloud scan fail?

Best regards,

Min

Yes, Microsoft Defender for Storage can return a "successful scan" result for a PDF file protected with an Open Password.

No, this does not mean the file was fully scanned in the traditional sense.

PDFs protected with an Open Password still expose parts of their metadata and structure, which may include:

• Document metadata (title, author, etc.)
• Embedded scripts or objects outside the encrypted content stream

The Defender for Storage scanner leverages Microsoft Defender Antivirus engines, which can analyze these accessible portions. If no threats are found in those areas, the scan result is marked as "success".

However, the core content the encrypted portion is not decrypted or scanned, meaning:

• The file could still contain malicious payloads hidden in the protected content.
• From a security posture perspective, the file should be treated as not fully scanned. https://learn.microsoft.com/en-us/azure/defender-for-cloud/introduction-malware-scanning https://learn.microsoft.com/en-us/azure/defender-for-cloud/on-upload-malware-scanning

Hope this help!

Thanks for clarification, that was really helpful 😊

However, the core content the encrypted portion is not decrypted or scanned

Which unfortunately means we cannot 100% rely on defender scan status.

Is there any place where we can request for a feature, e.g. in defender for storage settings, to fail the file if it is not completely scanned?

Hello Min,

Thanks for your follow-up! You're absolutely right to be thinking critically about the implications of a "successful" scan result when the core content of a password-protected file like a PDF with an Open Password is not actually scanned.

As of now, Microsoft Defender for Storage does not offer a built-in setting to automatically fail or flag a scan result when the file content is only partially scanned (e.g., due to encryption or password protection). This limitation is acknowledged in Microsoft documentation, which explains that scan results may still show as "successful" if accessible metadata or non-encrypted portions are clean even if the main content remains unscanned.

We can recommend use Custom Enforcement via Azure Functions or Logic Apps

To enforce stricter controls, Microsoft recommends implementing custom logic using Azure-native tools:

Blob-triggered Azure Function or Logic App: Detect when a new file is uploaded.

File inspection logic: Use a script or third-party library to determine if the file is password-protected.

Custom alerting: If the file is protected and cannot be fully scanned, trigger an alert or move the file to a quarantine container.

Again, this approach allows you to treat partially scanned files as potential risks, even if Defender for Storage reports them as clean.

Unfortunately, there is currently no direct toggle or setting in Defender for Storage to enforce scan failure on partial scans. However, you can post your feedback in our Azure feedback portal regarding the feature. 

https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789
This channel is directly monitored by our PM's. They will look into this request and revert back to you directly with an update on this feature.
Hope I was able to clarify your doubt somehow. Happy to help!

Regards,

Monalisha