Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
sqlserver_auditing_retention_90_daysProvider: Azure
Service:
sqlserverSeverity: MEDIUM
Categories:
logging, forensics-readyResource type:
microsoft.sql/serversWhat this check verifies
Azure SQL Server auditing settings are evaluated to ensure auditing is enabled and log retention is greater than90 days. It considers the auditing policy state and the configured retention_days value.
Risk
Without adequate retention or with auditing disabled, activity trails expire too soon, limiting detection and investigation of unauthorized access, data exfiltration, and privilege abuse. This weakens confidentiality and integrity and slows incident response.Recommendation
Enable server-level auditing and set retention above90 days, aligned with policy needs. Store logs in tamper-resistant, centralized storage, restrict access with least privilege, and integrate alerting and review. Apply defense in depth with continuous monitoring.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
Set-AzSqlServerAudit -ResourceGroupName <example_resource_name> -ServerName <example_resource_name> -RetentionInDays 91 -LogAnalyticsTargetState Enabled -WorkspaceResourceId <example_resource_id>
References
- https://learn.microsoft.com/en-us/purview/audit-log-retention-policies
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/Sql/auditing-retention.html#
- https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = sqlserver_auditing_retention_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks