Does anyone know where umbraco forms stores it's uploaded files? I have setup an S3 virtual file system provider for Media storage to share it between editing instance and delivery instance. Do I need to do the same for forms?

It does. And we recently asked by a client to virus check them which Azure does really nicely

What service are you using for the virus checking? I've been asked that too but the process normally ends up being something like: - upload to quarantine blob storage account - trigger function to run clamav against file - once complete move to another blob storage account

We used "Malware scanning in Defender for Storage" Microsoft now has an updated version Malware scanning in Defender for Storage that can scan in “Almost” real time*: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-malware-scan *So the file will hit the blob storage but is scanned as soon as it does. We can then have a workflow in place that deletes it: https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware This means that: 1. the form is submitted 2. the attachment is uploaded 3. it is checked 4. if it is malicious it is deleted 5. the record stays in Umbraco forms but without an attachment

hmmm... interesting. I'll pass this on to our client for review. Thanks