Back to Checks
azure

Defender for SQL servers on machines is set to On (Standard pricing tier)

defender_ensure_defender_for_sql_servers_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/pricings

Subscription pricing for Defender for SQL Server on Machines is configured to the Standard plan, covering SQL Server instances running on virtual machines.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender for SQL Server on Machines, attacks on SQL Server VMs can go undetected-including SQL injection, brute-force logons, and privilege abuse.

This risks data exfiltration (C), schema or record tampering (I), and outages or ransomware impact (A), while reducing visibility and delaying response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_sql_servers_is_on

Recommendation

Enable the Defender for SQL Server on Machines plan at the Standard tier for subscriptions hosting SQL Server VMs.

Apply defense-in-depth: enforce least privilege and strong authentication, segment networks, keep SQL patched, enable auditing, and route alerts to a SIEM for rapid containment.

Remediation

CLI

az security pricing create -n SqlServerVirtualMachines --tier Standard

Terraform

resource "azurerm_security_center_subscription_pricing" "<example_resource_name>" {
  resource_type = "SqlServerVirtualMachines" # Critical: target the SQL Server VMs Defender plan
  tier          = "Standard"                 # Critical: enable Standard (ON)
}

NativeIaC

// Enable Microsoft Defender for SQL servers on machines at subscription scope
targetScope = 'subscription'

resource pricing 'Microsoft.Security/pricings@2022-03-01' = {
  name: 'SqlServerVirtualMachines'
  properties: {
    pricingTier: 'Standard' // Critical: sets Defender plan to Standard (ON) for SQL Server VMs
  }
}

Other

1In the Azure Portal, go to Microsoft Defender for Cloud
2Click Environment settings and select the target subscription
3Open Defender plans (Plans)
4Find SQL servers on machines and set it to Standard (On)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_sql_servers_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "SqlServerVirtualMachines" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=pricings["SqlServerVirtualMachines"],
                )
                report.subscription = subscription
                report.resource_name = "Defender plan SQL Server VMs"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for SQL Server VMs from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["SqlServerVirtualMachines"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for SQL Server VMs from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References