Update TrendAI Cloud One File Storage Security to TrendAI Vision One File Security Storage for Azure

Choose an update path

• Zero downtime: Choose this path if scanning must not be interrupted. Be aware that during the interval before C1FSS scanning stops, a newly uploaded blob might be scanned by both C1FSS and V1FSS. If the promote-or-quarantine plugin is in use, this can cause race conditions, which lead to inconsistent tags, an inconsistent file state (one product moves a blob while the other is still reading it), or duplicate processing (both products attempt the same move, and whichever one wins deletes the source while the other logs a failure).
• Brief downtime: Choose this path if you can tolerate a short interruption of scanning. Scanning pauses only between deleting the C1FSS event subscription and turning on scanning in the TrendAI Vision One console, which is typically a few minutes. This path has the least chance of problems during the update, and is the better choice if you use the promote-or-quarantine plugin.

Before you begin

1. Confirm that you are not using a VNet deployment.

   Important V1FSS does not support VNet deployment. If C1FSS is deployed into a virtual network, do not update. There is no equivalent configuration in V1FSS, and updating moves your scanning from a network-isolated pipeline to a public-endpoint one.

   Supported deployment types

   Deployment type	Update supported?
   All-in-One (Scanner and Storage stacks)	Yes
   Storage stack only	Yes
   Scanner stack only	Yes
   Any stack deployed into a VNet	No

2. Check whether you use the promote-or-quarantine plugin.
   C1FSS can move clean or malicious blobs to other storage accounts, but only through a separate plugin deployed once per scanning storage account. V1FSS has this capability built in, but the settings do not carry across automatically, and one default differs in a way that changes where your files land.
   Go to Azure portal → Resource groups and look for resource groups that contain a pqfunction… storage account. Each one is a plugin instance. If you find any, see Update promote and quarantine settings.
3. Record the C1FSS event subscription details.
   C1FSS creates an Event Grid event subscription on each scanned storage account, which triggers its Blob Listener function whenever a blob is uploaded. You delete this subscription during the update, so record it first. This information is required if you need to roll back to C1FSS.
   Do the following for each storage account that C1FSS protects:
   1. Go to Azure portal → Storage accounts and open the storage account.
   2. In the left navigation, select Events, and then open the Event Subscriptions tab.
   3. Find the subscription named tmbl0…-trigger. This is the subscription C1FSS created.
   4. Open the subscription and note down the subscription name, event types, endpoint type, endpoint, and any filters.
   5. Save this information somewhere accessible, for example a text file or a ticket comment.

   C1FSS event subscription details

   Name	Event types	Filters	Endpoint type	Endpoint
   tmbl0<uid>-trigger	Microsoft.Storage.BlobCreated, Microsoft.Storage.BlobRenamed	None	Azure Function	tmbl0<uid> (Blob Listener)

   You return to this Events page several times during the update. It is where you confirm that the V1FSS subscription appears beside the C1FSS one, where you delete the C1FSS subscription at cutover, and where you recreate the C1FSS subscription if you roll back.

   Note If a storage account has no tmbl0…-trigger subscription, C1FSS is not scanning it. Leave that storage account out of the update.

4. Identify the C1FSS resource groups.
   C1FSS resources carry no tags, so you identify them by name. The default resource group names are Scanner-TM-FileStorageSecurity and Storage-TM-FileStorageSecurity, but the names were chosen at deployment time and might have been changed. Every resource in a C1FSS resource group shares the same generated 13-character suffix and is named tm<role>0<suffix>, where <role> identifies the component.
   Go to Azure portal → Resource groups and look for groups containing resources whose names start with tm.

   C1FSS resource groups

   If it contains	It is the	Typical default name
   tmsf0… (function app), tmsbq0… (Service Bus)	Scanner resource group, one per region	Scanner-TM-FileStorageSecurity
   tmbl0… and tmat0… (function apps)	Storage resource group, one per protected storage account	Storage-TM-FileStorageSecurity

5. Confirm that you have the required permissions.
   You need permissions on two planes, and subscription Owner alone is not enough.
   • Microsoft Entra ID (your directory): TrendAI Vision One creates an app registration and a service principal in your tenant, so you need the Application Administrator role or equivalent.
   • The Azure subscription: You need permission to create resource groups, storage accounts, key vaults, Service Bus namespaces, function apps, managed identities, and Event Grid topics and subscriptions, as well as role definitions and role assignments.
   You also need enough quota in each target region. The limit that matters most often is Elastic Premium App Service plans, because V1FSS uses EP1. For more information, see Deploy File Security Storage to Azure.

   Note You do not need to check permissions and quota by hand. Step 1 of either update path runs ./deploy.sh preflight, a read-only check that reports exactly what is missing before anything is created.

Update promote and quarantine settings

Important These connection strings contain storage account keys. Copy out only the account name, and do not paste the whole value anywhere.

1. Where blobs go.

   # If every protected storage account used the same destination:
   clean_storage_account      = jsonencode({ global = "mycleanaccount" })
   quarantine_storage_account = jsonencode({ global = "myquarantineaccount" })
   
   # If destinations differed per storage account:
   quarantine_storage_account = jsonencode({
     custom = {
       "sourceaccount1" = { destAccount = "quarantineaccount1" }
       "sourceaccount2" = { destAccount = "quarantineaccount2" }
     }
   })

   Leave a variable as jsonencode({}) if that action was turned off. Those blobs are tagged in place, exactly as before.

   Important Use global only if every storage account you are protecting had a plugin for that action. A global value applies to all of them, including any that never had a plugin, and those storage accounts were only tagged under C1FSS. If you give them a destination, V1FSS starts moving their blobs. If only some storage accounts had a plugin, use the custom form, which affects only the accounts you list.

2. Where blobs land inside the destination. You must change this value.

   use_source_storage_account_as_container = false

   The package ships with true, which is the correct default for a new deployment but not for an update.

   Destination paths

   Configuration	Path your blobs land at
   C1FSS plugin	<destination>/<source-container>/<blob>
   V1FSS with false	<destination>/<source-container>/<blob>, the same as C1FSS
   V1FSS with true	<destination>/<source-account>/<source-container>/<blob>, which is different

   If anything reads your quarantined or promoted blobs by path, true breaks it at cutover.
3. Leave the failure destination empty, to match C1FSS.

   failure_storage_account = jsonencode({})

   C1FSS left blobs whose scan failed in place. V1FSS can move them somewhere instead, which is a new capability but not your current behavior.

• Copy mode. If PROMOTEMODE or QUARANTINEMODE was copy, C1FSS left the original blob in place. V1FSS always moves the blob: it copies the blob to the destination and then deletes the original. Make sure nothing depends on the original staying in the source storage account.
• Destinations in another subscription. C1FSS used a storage account key, so the destination could be anywhere. V1FSS uses its own managed identity, which is scoped to this subscription. If a destination is in a different subscription, move it into this one, or ask your Azure administrator to grant the v1fss-…-function-identity identity access to it after deployment.

What changes after the update

• Scan results are always written to both metadata and index tags. C1FSS let you turn metadata off with UpdateScanResultToBlobMetadata = No. V1FSS does not: every scanned blob gets fss- index tags as well as fssScanned, fssScanResult, fssScanDate, fssScanDetailCode, and fssScanDetailMessage metadata. If you ran C1FSS with metadata off, check anything that reads or compares blob metadata before you update.
• Your Azure bill profile changes if C1FSS ran on the consumption plan. V1FSS uses an always-allocated Elastic Premium (EP1) plan instead of pay-per-execution, which is a fixed per-region cost in exchange for no cold starts. This is by design.
• Logs go to a new workspace. V1FSS creates its own Log Analytics workspace and Application Insights instance (v1fss-<region>-…) rather than using one you supply. Point any saved queries or alerts at the new workspace.
• Promote and quarantine always move blobs, never copy them.
• Scan history stays in Cloud One. TrendAI Vision One starts fresh at cutover. Export anything you need to keep before your Cloud One tenant is removed.

• VNet deployment: Not supported in V1FSS, so do not update a VNet deployment.
• Reporting object keys to the backend (ReportObjectKey): No equivalent in V1FSS.
• A custom Event Grid topic name: Harmless. V1FSS finds the topic by the storage account it watches.

• Blob moving without a separate plugin, built into V1FSS and configured once instead of once per storage account, with no storage account keys to manage.
• A destination for failed scans (failure_storage_account). C1FSS left those blobs in place.
• Detections in TrendAI Vision One XDR, alongside the rest of your security data.

Common questions