Check ID: defender_ensure_defender_for_sql_servers_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities
Resource type: microsoft.security/pricings

What this check verifies

Subscription pricing for Defender for SQL Server on Machines is configured to the Standard plan, covering SQL Server instances running on virtual machines.

Risk

Without Defender for SQL Server on Machines, attacks on SQL Server VMs can go undetected-including SQL injection, brute-force logons, and privilege abuse. This risks data exfiltration (C), schema or record tampering (I), and outages or ransomware impact (A), while reducing visibility and delaying response.

Recommendation

Enable the Defender for SQL Server on Machines plan at the Standard tier for subscriptions hosting SQL Server VMs. Apply defense-in-depth: enforce least privilege and strong authentication, segment networks, keep SQL patched, enable auditing, and route alerts to a SIEM for rapid containment.

Remediation

az security pricing create -n SqlServerVirtualMachines —tier Standard

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_defender_for_sql_servers_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks