Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_defender_for_sql_servers_is_onProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
vulnerabilitiesResource type:
microsoft.security/pricingsWhat this check verifies
Subscription pricing for Defender for SQL Server on Machines is configured to theStandard plan, covering SQL Server instances running on virtual machines.
Risk
Without Defender for SQL Server on Machines, attacks on SQL Server VMs can go undetected-including SQL injection, brute-force logons, and privilege abuse. This risks data exfiltration (C), schema or record tampering (I), and outages or ransomware impact (A), while reducing visibility and delaying response.Recommendation
Enable the Defender for SQL Server on Machines plan at theStandard tier for subscriptions hosting SQL Server VMs.
Apply defense-in-depth: enforce least privilege and strong authentication, segment networks, keep SQL patched, enable auditing, and route alerts to a SIEM for rapid containment.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az security pricing create -n SqlServerVirtualMachines —tier Standard
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-sql-server-virtual-machines.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_defender_for_sql_servers_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks