Back to Checks
azure

Defender for Databases is set to On (Standard pricing tier)

defender_ensure_defender_for_databases_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/pricings

Azure subscription is evaluated for Defender for Databases coverage: Standard pricing must be enabled for SqlServers, SqlServerVirtualMachines, OpenSourceRelationalDatabases, and CosmosDbs.

Prowler logoProwlerprowler-provider-azure

Risk

Without this coverage, database workloads lack advanced threat detection, vulnerability assessment, and behavior analytics.

Attacks like credential brute force, SQL injection, privilege abuse, and data exfiltration can go undetected, threatening confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_databases_is_on

Recommendation

Enable Defender for Databases at the Standard tier for all supported database types across subscriptions. Integrate alerts with monitoring, automate response, and enforce least privilege and network segmentation for defense in depth. Use policy to maintain continuous coverage for new resources.

Remediation

CLI

# Enable all Defender for Databases plans (must run each command separately)
az security pricing create --name SqlServers --tier Standard
az security pricing create --name SqlServerVirtualMachines --tier Standard
az security pricing create --name OpenSourceRelationalDatabases --tier Standard
az security pricing create --name CosmosDbs --tier Standard

Terraform

# Enable Microsoft Defender for Databases plans
resource "azurerm_security_center_subscription_pricing" "sqlservers" {
  resource_type = "SqlServers"
  tier          = "Standard" # Critical: enables Defender (Standard)
}

resource "azurerm_security_center_subscription_pricing" "sql_vm" {
  resource_type = "SqlServerVirtualMachines"
  tier          = "Standard" # Critical: enables Defender (Standard)
}

resource "azurerm_security_center_subscription_pricing" "oss_db" {
  resource_type = "OpenSourceRelationalDatabases"
  tier          = "Standard" # Critical: enables Defender (Standard)
}

resource "azurerm_security_center_subscription_pricing" "cosmos" {
  resource_type = "CosmosDbs"
  tier          = "Standard" # Critical: enables Defender (Standard)
}

NativeIaC

// Enable Microsoft Defender for Databases plans at subscription scope
targetScope = 'subscription'

resource sqlServers 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'SqlServers'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for SQL servers to Standard (ON)
  }
}

resource sqlServerVMs 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'SqlServerVirtualMachines'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for SQL servers on machines to Standard (ON)
  }
}

resource openSourceDBs 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'OpenSourceRelationalDatabases'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for open-source databases to Standard (ON)
  }
}

resource cosmosDbs 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'CosmosDbs'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender for Cosmos DB to Standard (ON)
  }
}

Other

1In the Azure portal, go to Microsoft Defender for Cloud
2Select Environment settings > choose your subscription
3Open Defender plans
4Set these plans to On (Standard):
5- SQL servers
6- SQL servers on machines
7- Open-source relational databases
8- Cosmos DB
9Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_databases_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if (
                "SqlServers" in pricings
                and "SqlServerVirtualMachines" in pricings
                and "OpenSourceRelationalDatabases" in pricings
                and "CosmosDbs" in pricings
            ):
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["SqlServers"]
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for Databases from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if (
                    pricings["SqlServers"].pricing_tier != "Standard"
                    or pricings["SqlServerVirtualMachines"].pricing_tier != "Standard"
                    or pricings["OpenSourceRelationalDatabases"].pricing_tier
                    != "Standard"
                    or pricings["CosmosDbs"].pricing_tier != "Standard"
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for Databases from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References