SQL server vulnerability assessment has a storage container

Check ID: sqlserver_vulnerability_assessment_enabled
Provider: Azure
Service: sqlserver
Severity: MEDIUM
Categories: vulnerabilities
Resource type: microsoft.sql/servers

What this check verifies

Azure SQL Server has Vulnerability Assessment configured with a defined location to persist assessment reports and scan results

Risk

Without Vulnerability Assessment, misconfigurations and excessive permissions can go unnoticed. Adversaries may exploit weak server or database settings to escalate privileges, exfiltrate data, or alter records, degrading confidentiality and integrity.

Recommendation

Enable and standardize Vulnerability Assessment across SQL servers and databases, retaining scan results in a secure repository. Run scans routinely, review findings, set baselines, and remediate promptly. Apply least privilege to report access and integrate results into change management for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

Update-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName <RESOURCE_GROUP> -ServerName <SERVER_NAME> -StorageAccountName <STORAGE_ACCOUNT_NAME> -ScanResultsContainerName <CONTAINER_NAME>

# Enable server security alert policy (required by VA)
resource "azurerm_mssql_server_security_alert_policy" "<example_resource_name>" {
  resource_group_name = "<example_resource_name>"
  server_name         = "<example_resource_name>"
  state               = "Enabled"
}

# Configure VA (classic) with storage container
resource "azurerm_mssql_server_vulnerability_assessment" "<example_resource_name>" {
  server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.<example_resource_name>.id
  storage_container_path          = "https://<example_resource_name>.blob.core.windows.net/<example_resource_name>" # CRITICAL: sets storage container path so the check passes
  storage_account_access_key      = "<example_resource_name>"
}

// Configure VA (classic) at the SQL Server level
resource sqlServerVA 'Microsoft.Sql/servers/vulnerabilityAssessments@2021-11-01' = {
  name: '<example_resource_name>/default'
  properties: {
    storageContainerPath: 'https://<example_resource_name>.blob.core.windows.net/<example_resource_name>' // CRITICAL: sets the storage container path to enable VA
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = sqlserver_vulnerability_assessment_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

SQL server vulnerability scan reports have recipients Storage account has shared key access disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires