Check ID: defender_ensure_defender_for_azure_sql_databases_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities
Resource type: microsoft.security/pricings

What this check verifies

Microsoft Defender for Cloud plan for Azure SQL Database Servers is evaluated at subscription scope, expecting the pricing_tier set to Standard for SqlServers. Non-standard tiers indicate the plan isn’t enabled.

Risk

Without Defender for SQL, attacks like SQL injection, brute-force logins, and anomalous queries may go undetected, enabling data exfiltration and tampering. Limited telemetry delays incident response, risking loss of confidentiality and integrity and aiding lateral movement.

Recommendation

Enable the Microsoft Defender plan for Azure SQL databases with pricing_tier: Standard across applicable subscriptions. Integrate alerts with SIEM, enforce least privilege and separation of duties, and apply defense in depth (network controls, MFA) to prevent and promptly detect misuse.

Remediation

az security pricing create —name SqlServers —tier Standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_azure_sql_databases_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks