Defender for Storage: enabling fails with "Failed to disable advanceThreatProtectionSettings" (500), subscription-level plan doesn't apply either

can't enable Microsoft Defender for Storage (with on-upload malware scanning) on any storage account of my subscription. I've tried the resource level, the subscription level, a brand-new storage account, Bicep, the portal and the CLI, and none of them works. Any help on what blocks it, or how to reset it, is welcome.

Environment

• Pay-As-You-Go subscription, upgraded from a Free Trial in September 2026.
• Storage account: StorageV2, Standard_LRS, region France Central, public network access disabled (private endpoints).
• The Microsoft.Security resource provider is registered (since 2026-11-06).
• No resource locks. No deny policy: only auditIfNotExists policy actions appear in the activity log.
• The classic setting advancedThreatProtectionSettings/current on the account already returns "isEnabled": false.

1. Resource-level enablement fails

PUT {storageAccountId}/providers/Microsoft.Security/defenderForStorageSettings/current?api-version=2025-06-01
{"properties":{"isEnabled":true,
  "malwareScanning":{"onUpload":{"isEnabled":true,"capGBPerMonth":-1}},
  "sensitiveDataDiscovery":{"isEnabled":false},
  "overrideSubscriptionLevelSettings":true}}

Result:

Internal Server Error
{"error":{"code":"UnknownError","message":"Failed to disable advanceThreatProtectionSettings"}}

• The same body sent through an ARM/Bicep deployment (Microsoft.Security/DefenderForStorageSettings@2025-06-01) stays Running for about 3.5 hours, then fails with the same message. Every deployment since 2026-09-20 has done this. One example: Correlation ID 517d2c67-421c-470b-afd6-a165bd19f356 (deployment started 2026-11-07 02:13 UTC).
• Enabling it from the portal (storage account > Microsoft Defender for Cloud) fails within a minute with the same statusMessage.
• A brand-new StorageV2 account, with default settings and public access, in a new resource group of the same subscription, fails the same way. So this is not specific to my account's network configuration.
• Disabling at resource level ("isEnabled": false, "overrideSubscriptionLevelSettings": true) works fine.

2. Subscription-level plan is accepted but doesn't apply

PUT /subscriptions/{subId}/providers/Microsoft.Security/pricings/StorageAccounts?api-version=2024-01-01
{"properties":{"pricingTier":"Standard","subPlan":"DefenderForStorageV2",
  "extensions":[{"name":"OnUploadMalwareScanning","isEnabled":"True",
                 "additionalExtensionProperties":{"CapGBPerMonthPerStorageAccount":"-1"}},
                {"name":"SensitiveDataDiscovery","isEnabled":"False"}]}}

This succeeds: "Successfully enabled extension", "resourcesCoverageStatus": "FullyCovered", enablement time 2026-11-07 14:15 UTC. But more than an hour later:

• defenderForStorageSettings/current on the storage account (overrideSubscriptionLevelSettings: false) still returns isEnabled: false and malwareScanning.onUpload.isEnabled: false;
• an on-demand scan is refused:

POST {storageAccountId}/providers/Microsoft.Security/defenderForStorageSettings/current/startMalwareScan?api-version=2025-06-01
Bad Request
{"error":{"code":"OnUploadNotConfigured","message":"Unable to start on-demand malware scan since AntimalwareOnUploadScanning is not enabled."}}

Questions

1. What does "Failed to disable advanceThreatProtectionSettings" mean when the classic setting is already disabled? Is a leftover state of the classic (per-transaction) plan, or of the Free Trial, blocking the switch to the new plan?
2. Is there a way to reset this state on the subscription, through an API, a CLI command or the portal?
3. Why doesn't the subscription-level plan reach the storage account's settings, although it reports FullyCovered?

All times are UTC. I can share the subscription ID privately with a Microsoft engineer. can't enable Microsoft Defender for Storage (with on-upload malware scanning) on any storage account of my subscription. I've tried the resource level, the subscription level, a brand-new storage account, Bicep, the portal and the CLI, and none of them works. Any help on what blocks it, or how to reset it, is welcome.

Environment

• Pay-As-You-Go subscription, upgraded from a Free Trial in September 2026.
• Storage account: StorageV2, Standard_LRS, region France Central, public network access disabled (private endpoints).
• The Microsoft.Security resource provider is registered (since 2026-11-06).
• No resource locks. No deny policy: only auditIfNotExists policy actions appear in the activity log.
• The classic setting advancedThreatProtectionSettings/current on the account already returns "isEnabled": false.

1. Resource-level enablement fails

PUT {storageAccountId}/providers/Microsoft.Security/defenderForStorageSettings/current?api-version=2025-06-01
{"properties":{"isEnabled":true,
  "malwareScanning":{"onUpload":{"isEnabled":true,"capGBPerMonth":-1}},
  "sensitiveDataDiscovery":{"isEnabled":false},
  "overrideSubscriptionLevelSettings":true}}

Result:

Internal Server Error
{"error":{"code":"UnknownError","message":"Failed to disable advanceThreatProtectionSettings"}}

• The same body sent through an ARM/Bicep deployment (Microsoft.Security/DefenderForStorageSettings@2025-06-01) stays Running for about 3.5 hours, then fails with the same message. Every deployment since 2026-09-20 has done this. One example: Correlation ID 517d2c67-421c-470b-afd6-a165bd19f356 (deployment started 2026-11-07 02:13 UTC).
• Enabling it from the portal (storage account > Microsoft Defender for Cloud) fails within a minute with the same statusMessage.
• A brand-new StorageV2 account, with default settings and public access, in a new resource group of the same subscription, fails the same way. So this is not specific to my account's network configuration.
• Disabling at resource level ("isEnabled": false, "overrideSubscriptionLevelSettings": true) works fine.

2. Subscription-level plan is accepted but doesn't apply

PUT /subscriptions/{subId}/providers/Microsoft.Security/pricings/StorageAccounts?api-version=2024-01-01
{"properties":{"pricingTier":"Standard","subPlan":"DefenderForStorageV2",
  "extensions":[{"name":"OnUploadMalwareScanning","isEnabled":"True",
                 "additionalExtensionProperties":{"CapGBPerMonthPerStorageAccount":"-1"}},
                {"name":"SensitiveDataDiscovery","isEnabled":"False"}]}}

This succeeds: "Successfully enabled extension", "resourcesCoverageStatus": "FullyCovered", enablement time 2026-11-07 14:15 UTC. But more than an hour later:

• defenderForStorageSettings/current on the storage account (overrideSubscriptionLevelSettings: false) still returns isEnabled: false and malwareScanning.onUpload.isEnabled: false;
• an on-demand scan is refused:

POST {storageAccountId}/providers/Microsoft.Security/defenderForStorageSettings/current/startMalwareScan?api-version=2025-06-01
Bad Request
{"error":{"code":"OnUploadNotConfigured","message":"Unable to start on-demand malware scan since AntimalwareOnUploadScanning is not enabled."}}

Questions

1. What does "Failed to disable advanceThreatProtectionSettings" mean when the classic setting is already disabled? Is a leftover state of the classic (per-transaction) plan, or of the Free Trial, blocking the switch to the new plan?
2. Is there a way to reset this state on the subscription, through an API, a CLI command or the portal?
3. Why doesn't the subscription-level plan reach the storage account's settings, although it reports FullyCovered?

All times are UTC. I can share the subscription ID privately with a Microsoft engineer.