Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
sqlserver_microsoft_defender_enabledProvider: Azure
Service:
sqlserverSeverity: HIGH
Categories:
logging, forensics-readyResource type:
microsoft.sql/serversWhat this check verifies
Azure SQL Server instances are evaluated for the server-level security alert policy of Microsoft Defender for SQL, expecting the policy state to beEnabled.
Risk
Without Defender for SQL, anomalous logins, SQL injection patterns, and risky configurations may go undetected, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and disruptive queries or ransomware (availability).Recommendation
Enable Microsoft Defender for SQL across all servers and managed instances, preferably at subscription scope. Apply least privilege, restrict public exposure, and integrate alerts with your SOC. Regularly review vulnerability assessment results and harden findings as part of defense in depth.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://www.azadvertizer.net/azpolicyadvertizer/7fe3b40f-802b-4cdd-8bd4-fd799c948cc2.html
- https://learn.microsoft.com/en-us/azure/azure-sql/database/azure-defender-for-sql?view=azuresql
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-usage
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/SecurityCenter/defender-azure-sql.html
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/policy-reference
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = sqlserver_microsoft_defender_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks