Defender for Storage emits Microsoft.Security.MalwareScanningResult with undocumented dataVersion: "1.1"

We are implementing Microsoft Defender for Storage on-upload malware scanning with scan results delivered through Event Grid to an Entra-authenticated webhook.

The integration is working through authentication: genuine Microsoft.Security.MalwareScanningResult events are being generated by Defender, delivered by Event Grid, and successfully authenticated by our webhook.

During production-readiness testing we found that the actual Defender event contains:

dataVersion: "1.1"

Our implementation was based on Microsoft’s published Defender for Storage malware-scan event contract/sample, which identifies dataVersion: "1.0". Generic Event Grid documentation indicates that dataVersion is publisher-defined, so we do not want to assume that an undocumented Defender version is backward-compatible.

We captured "1.1" from a natural retry of a genuine Defender-generated event. It was not a synthetic event or manual replay.

Our application deliberately remains fail-closed and has not been changed to accept arbitrary version strings.

Can Microsoft confirm:

1. Is dataVersion: "1.1" officially supported for Microsoft.Security.MalwareScanningResult?
2. What changed between versions 1.0 and 1.1?
3. Is the 1.1 data payload backward-compatible with 1.0?
4. Should consumers explicitly allow both "1.0" and "1.1"?
5. Are there any other supported dataVersion values consumers should expect?
6. Is there authoritative documentation/schema for version 1.1?

Environment:

• Defender for Storage on-upload malware scanning
• Azure region: Canada Central
• Event Grid Schema
• Dedicated custom Event Grid result topic
• Entra-authenticated webhook
• Private Blob container

We can provide sanitized diagnostics if useful, but have intentionally not retained authentication tokens or the complete provider payload.We are implementing Microsoft Defender for Storage on-upload malware scanning with scan results delivered through Event Grid to an Entra-authenticated webhook.

The integration is working through authentication: genuine Microsoft.Security.MalwareScanningResult events are being generated by Defender, delivered by Event Grid, and successfully authenticated by our webhook.

During production-readiness testing we found that the actual Defender event contains:

dataVersion: "1.1"

Our implementation was based on Microsoft’s published Defender for Storage malware-scan event contract/sample, which identifies dataVersion: "1.0". Generic Event Grid documentation indicates that dataVersion is publisher-defined, so we do not want to assume that an undocumented Defender version is backward-compatible.

We captured "1.1" from a natural retry of a genuine Defender-generated event. It was not a synthetic event or manual replay.

Our application deliberately remains fail-closed and has not been changed to accept arbitrary version strings.

Can Microsoft confirm:

1. Is dataVersion: "1.1" officially supported for Microsoft.Security.MalwareScanningResult?
2. What changed between versions 1.0 and 1.1?
3. Is the 1.1 data payload backward-compatible with 1.0?
4. Should consumers explicitly allow both "1.0" and "1.1"?
5. Are there any other supported dataVersion values consumers should expect?
6. Is there authoritative documentation/schema for version 1.1?

Environment:

• Defender for Storage on-upload malware scanning
• Azure region: Canada Central
• Event Grid Schema
• Dedicated custom Event Grid result topic
• Entra-authenticated webhook
• Private Blob container

We can provide sanitized diagnostics if useful, but have intentionally not retained authentication tokens or the complete provider payload.