SQL Server sends vulnerability assessment emails to admins

# Enable VA at server level and email subscription admins
resource "azurerm_mssql_server_security_alert_policy" "<example_resource_name>" {
  server_id = "<example_resource_id>"
  state     = "Enabled"
}

resource "azurerm_mssql_server_vulnerability_assessment" "<example_resource_name>" {
  server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.<example_resource_name>.id
  storage_container_path          = "https://<example_resource_name>.blob.core.windows.net/<example_resource_name>" # Critical: required so the check detects VA configured
  storage_account_access_key      = "<example_resource_id>"

  recurring_scans {
    enabled                   = true
    email_subscription_admins = true # Critical: sends scan reports to subscription admins to PASS the check
  }
}

// Enable VA at server level with classic storage and email to subscription admins
resource sqlServer 'Microsoft.Sql/servers@2021-11-01' existing = {
  name: '<example_resource_name>'
}

resource va 'Microsoft.Sql/servers/vulnerabilityAssessments@2021-11-01' = {
  name: 'default'
  parent: sqlServer
  properties: {
    storageContainerPath: 'https://<example_resource_name>.blob.core.windows.net/<example_resource_name>' // Critical: required so the check detects VA configured
    storageAccountAccessKey: '<example_resource_id>'
    recurringScans: {
      isEnabled: true
      emailSubscriptionAdmins: true // Critical: sends scan reports to subscription admins to PASS the check
    }
  }
}