SQL Server vulnerability assessment scans recur

Check ID: sqlserver_va_periodic_recurring_scans_enabled
Provider: Azure
Service: sqlserver
Severity: MEDIUM
Categories: vulnerabilities
Resource type: microsoft.sql/servers

What this check verifies

Azure SQL servers are evaluated for Vulnerability Assessment configuration and whether periodic recurring scans are scheduled (e.g., weekly) for the server and its databases. Servers with Vulnerability Assessment missing or scans not scheduled are identified.

Risk

Without scheduled scans, new misconfigurations and vulnerable settings can persist unnoticed, weakening confidentiality and integrity. Attackers can exploit stale permissions, unsafe firewall rules, or unpatched features to read or alter data and pivot to other resources.

Recommendation

Enable recurring Vulnerability Assessment scans at server scope and ensure results are retained securely (express configuration or secured storage). Apply least privilege, maintain baselines, and promptly remediate findings. Automate alerting and periodic reviews as part of defense in depth and change management.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az rest --method put --url https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Sql/servers/<SERVER_NAME>/vulnerabilityAssessments/Default?api-version=2023-08-01-preview --body '{"properties":{"storageContainerPath":"https://<STORAGE_ACCOUNT>.blob.core.windows.net/<CONTAINER>/","storageAccountAccessKey":"<ACCESS_KEY>","recurringScans":{"isEnabled":true}}}'

# Server VA with periodic recurring scans enabled
resource "azurerm_mssql_server_vulnerability_assessment" "<example_resource_name>" {
  server_security_alert_policy_id = "<example_resource_id>"
  storage_container_path          = "https://<example_storage_account>.blob.core.windows.net/<example_container>/" # Required so VA is configured
  storage_account_access_key      = "<example_access_key>"

  recurring_scans {
    enabled = true # CRITICAL: Enables periodic recurring scans
  }
}

// Enable classic VA with recurring scans on an existing SQL Server
resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' existing = {
  name: '<example_resource_name>'
}

resource va 'Microsoft.Sql/servers/vulnerabilityAssessments@2023-08-01-preview' = {
  name: 'Default'
  parent: sqlServer
  properties: {
    storageContainerPath: 'https://<example_storage_account>.blob.core.windows.net/<example_container>/' // CRITICAL: Required so VA is considered configured
    storageAccountAccessKey: '<example_access_key>'
    recurringScans: {
      isEnabled: true // CRITICAL: Enables periodic recurring scans
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = sqlserver_va_periodic_recurring_scans_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

SQL Server sends vulnerability assessment emails to admins SQL server vulnerability scan reports have recipients

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires