Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_azure_sql_databases_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
vulnerabilitiesResource type:
microsoft.security/pricingsWhat this check verifies
Microsoft Defender for Cloud plan for Azure SQL Database Servers is evaluated at subscription scope, expecting thepricing_tier set to Standard for SqlServers. Non-standard tiers indicate the plan isn’t enabled.
Risk
Without Defender for SQL, attacks like SQL injection, brute-force logins, and anomalous queries may go undetected, enabling data exfiltration and tampering. Limited telemetry delays incident response, risking loss of confidentiality and integrity and aiding lateral movement.Recommendation
Enable the Microsoft Defender plan for Azure SQL databases withpricing_tier: Standard across applicable subscriptions. Integrate alerts with SIEM, enforce least privilege and separation of duties, and apply defense in depth (network controls, MFA) to prevent and promptly detect misuse.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create —name SqlServers —tier Standard
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-azure-sql.html
- https://learn.microsoft.com/en-us/azure/azure-sql/database/azure-defender-for-sql?view=azuresql
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_azure_sql_databases_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks