Check ID: defender_ensure_defender_for_databases_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities
Resource type: microsoft.security/pricings

What this check verifies

Azure subscription is evaluated for Defender for Databases coverage: Standard pricing must be enabled for SqlServers, SqlServerVirtualMachines, OpenSourceRelationalDatabases, and CosmosDbs.

Risk

Without this coverage, database workloads lack advanced threat detection, vulnerability assessment, and behavior analytics. Attacks like credential brute force, SQL injection, privilege abuse, and data exfiltration can go undetected, threatening confidentiality, integrity, and availability.

Recommendation

Enable Defender for Databases at the Standard tier for all supported database types across subscriptions. Integrate alerts with monitoring, automate response, and enforce least privilege and network segmentation for defense in depth. Use policy to maintain continuous coverage for new resources.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

Enable all Defender for Databases plans (must run each command separately)

az security pricing create —name SqlServers —tier Standard az security pricing create —name SqlServerVirtualMachines —tier Standard az security pricing create —name OpenSourceRelationalDatabases —tier Standard az security pricing create —name CosmosDbs —tier Standard

# Enable Microsoft Defender for Databases plans
resource "azurerm_security_center_subscription_pricing" "sqlservers" {
  resource_type = "SqlServers"
  tier          = "Standard" # Critical: enables Defender (Standard)
}

resource "azurerm_security_center_subscription_pricing" "sql_vm" {
  resource_type = "SqlServerVirtualMachines"
  tier          = "Standard" # Critical: enables Defender (Standard)
}

resource "azurerm_security_center_subscription_pricing" "oss_db" {
  resource_type = "OpenSourceRelationalDatabases"
  tier          = "Standard" # Critical: enables Defender (Standard)
}

resource "azurerm_security_center_subscription_pricing" "cosmos" {
  resource_type = "CosmosDbs"
  tier          = "Standard" # Critical: enables Defender (Standard)
}

// Enable Microsoft Defender for Databases plans at subscription scope
targetScope = 'subscription'

resource sqlServers 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'SqlServers'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for SQL servers to Standard (ON)
  }
}

resource sqlServerVMs 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'SqlServerVirtualMachines'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for SQL servers on machines to Standard (ON)
  }
}

resource openSourceDBs 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'OpenSourceRelationalDatabases'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for open-source databases to Standard (ON)
  }
}

resource cosmosDbs 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'CosmosDbs'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for Cosmos DB to Standard (ON)
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_databases_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Defender for Cosmos DB is set to On (Standard pricing tier)Defender for DNS is set to On (Standard pricing tier)

​What this check verifies

​Risk

​Recommendation

​Remediation

​Enable all Defender for Databases plans (must run each command separately)

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

Enable all Defender for Databases plans (must run each command separately)

References

Where this check fires