Check ID: defender_ensure_defender_for_os_relational_databases_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities
Resource type: microsoft.security/pricings

What this check verifies

Microsoft Defender for Cloud plan for Open-Source Relational Databases is evaluated for the Standard pricing tier at the subscription level.

Risk

Absent the Standard plan, open-source databases lack threat detection and behavior analytics, reducing confidentiality and integrity. SQL injection, brute-force logins, and data exfiltration may go unnoticed, delaying response and enabling lateral movement.

Recommendation

Enable the plan at the Standard tier across relevant subscriptions. Apply defense in depth: enforce least privilege, isolate databases on private networks, require strong authentication, and route alerts to centralized monitoring for rapid triage. Review coverage regularly.

Remediation

az security pricing create —name OpenSourceRelationalDatabases —tier Standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_os_relational_databases_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks