Back to Checks
azure

Defender for Azure SQL databases is set to On (Standard pricing tier)

defender_ensure_defender_for_azure_sql_databases_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/pricings

Microsoft Defender for Cloud plan for Azure SQL Database Servers is evaluated at subscription scope, expecting the pricing_tier set to Standard for SqlServers. Non-standard tiers indicate the plan isn't enabled.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender for SQL, attacks like SQL injection, brute-force logins, and anomalous queries may go undetected, enabling data exfiltration and tampering. Limited telemetry delays incident response, risking loss of confidentiality and integrity and aiding lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_azure_sql_databases_is_on

Recommendation

Enable the Microsoft Defender plan for Azure SQL databases with pricing_tier: Standard across applicable subscriptions. Integrate alerts with SIEM, enforce least privilege and separation of duties, and apply defense in depth (network controls, MFA) to prevent and promptly detect misuse.

Remediation

CLI

az security pricing create --name SqlServers --tier Standard

Terraform

# Enable Microsoft Defender for Azure SQL Databases
resource "azurerm_security_center_subscription_pricing" "<example_resource_name>" {
  resource_type = "SqlServers"           # CRITICAL: Targets Azure SQL Databases plan
  tier          = "Standard"             # CRITICAL: Enables Defender (Standard)
}

NativeIaC

// Enable Microsoft Defender for Azure SQL Databases at subscription scope
targetScope = 'subscription'

resource sqlPricing 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'SqlServers'
  properties: {
    pricingTier: 'Standard' // CRITICAL: Sets Defender plan for Azure SQL DB to ON (Standard)
  }
}

Other

1In the Azure portal, go to Microsoft Defender for Cloud
2Select Environment settings > your subscription
3Open Defender plans
4Turn ON the plan for Azure SQL Databases (set to Standard)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_azure_sql_databases_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "SqlServers" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["SqlServers"]
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for Azure SQL DB Servers from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["SqlServers"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for Azure SQL DB Servers from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References