[Policy] Add custom policy for Microsoft Defender for Storage with full extension configurability

[juazasan-msft]

Is your feature request related to a problem? Please describe.

The built-in policy "Configure Microsoft Defender for Storage to be enabled" (cfdc5972-75b3-4418-8ae1-7f5c36839390) does not expose all configurable properties available on Microsoft.Security/pricings/StorageAccounts. It also has limitations around case handling and does not allow management of all Defender for Storage options through Azure Policy at scale.

This issue proposes adding a custom policy to the Policy/ folder that exposes the additional Storage Defender settings as parameters and deploys the full Microsoft.Security/pricings/StorageAccounts configuration at subscription scope.

When managing Defender for Storage through Azure Policy at Management Group scope, the built-in policy only exposes these parameters:

• effect
• isOnUploadMalwareScanningEnabled
• capGBPerMonthPerStorageAccount
• isSensitiveDataDiscoveryEnabled

However, the ARM resource supports additional configurable properties under OnUploadMalwareScanning that are not exposed by the built-in policy:

• AutomatedResponse
• BlobScanResultsOptions

This makes it impossible to manage the full Storage Defender configuration consistently via Azure Policy.

Describe the solution you'd like

Add a new custom policy definition to the Policy/ folder:

"CUSTOM - Configure Microsoft Defender for Storage to be enabled"

The policy should:

• Target Microsoft.Resources/subscriptions
• Use DeployIfNotExists effect (also support AuditIfNotExists and Disabled)
• Deploy Microsoft.Security/pricings/StorageAccounts
• Set pricingTier = Standard
• Set subPlan = DefenderForStorageV2
• Expose the following parameters:
  • isOnUploadMalwareScanningEnabled
  • capGBPerMonthPerStorageAccount
  • automatedResponseOption
  • blobScanResultsOption
  • isSensitiveDataDiscoveryEnabled
• Use Contributor as the required role for the assignment identity

Parameters

Parameter	Description	Default
effect	Enable or disable the execution of the policy	DeployIfNotExists
isOnUploadMalwareScanningEnabled	Enable malware scanning on blob uploads	True
capGBPerMonthPerStorageAccount	Limit the GB scanned per month per storage account	10
automatedResponseOption	Automated response for malware scanning findings	BlobSoftDelete
blobScanResultsOption	Where to store blob scan results	None
isSensitiveDataDiscoveryEnabled	Enable sensitive data discovery	True

Describe alternatives you've considered
AFAIK the only alternative is to wait for the built-in policy to be update.

Additional context

• Built-in policy: cfdc5972-75b3-4418-8ae1-7f5c36839390
• ARM resource type: Microsoft.Security/pricings (API version 2024-01-01)