Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_os_relational_databases_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
vulnerabilitiesResource type:
microsoft.security/pricingsWhat this check verifies
Microsoft Defender for Cloud plan for Open-Source Relational Databases is evaluated for theStandard pricing tier at the subscription level.
Risk
Absent theStandard plan, open-source databases lack threat detection and behavior analytics, reducing confidentiality and integrity. SQL injection, brute-force logins, and data exfiltration may go unnoticed, delaying response and enabling lateral movement.
Recommendation
Enable the plan at theStandard tier across relevant subscriptions. Apply defense in depth: enforce least privilege, isolate databases on private networks, require strong authentication, and route alerts to centralized monitoring for rapid triage. Review coverage regularly.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create —name OpenSourceRelationalDatabases —tier Standard
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-databases-introduction
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-relational-database.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_os_relational_databases_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks