Check ID: sqlserver_microsoft_defender_enabled
Provider: Azure
Service: sqlserver
Severity: HIGH
Categories: logging, forensics-ready
Resource type: microsoft.sql/servers

What this check verifies

Azure SQL Server instances are evaluated for the server-level security alert policy of Microsoft Defender for SQL, expecting the policy state to be Enabled.

Risk

Without Defender for SQL, anomalous logins, SQL injection patterns, and risky configurations may go undetected, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and disruptive queries or ransomware (availability).

Recommendation

Enable Microsoft Defender for SQL across all servers and managed instances, preferably at subscription scope. Apply least privilege, restrict public exposure, and integrate alerts with your SOC. Regularly review vulnerability assessment results and harden findings as part of defense in depth.

Remediation

az rest --method PUT --url "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Sql/servers/<SERVER_NAME>/securityAlertPolicies/Default?api-version=2023-08-01-preview" --body '{"properties":{"state":"Enabled"}}'

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = sqlserver_microsoft_defender_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks