Back to Checks
azure

SQL Server has an auditing policy configured

sqlserver_auditing_enabled
Service: sqlserverSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.sql/servers

Azure SQL Server auditing is assessed at the server level to confirm audit logging is active. Configurations with any auditing policy state set to Disabled indicate auditing is not configured for the server and its databases.

Prowler logoProwlerprowler-provider-azure

Risk

Without SQL auditing, visibility into logins, privilege changes, and query activity is lost. Stealthy data exfiltration and tampering can go undetected, impacting confidentiality and integrity. Absent audit trails hinder forensics, slow incident response, and weaken compliance evidence.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks sqlserver_auditing_enabled

Recommendation

Enable server-level auditing and send logs to a centralized, tamper-resistant store with defined retention. Enforce least privilege and separation of duties for log access, integrate with monitoring for alerts, and periodically validate coverage. Use database-level auditing only for specific exceptions.

Remediation

CLI

az sql server audit-policy update --resource-group <RESOURCE_GROUP_NAME> --name <SERVER_NAME> --state Enabled --storage-account <STORAGE_ACCOUNT_NAME>

Terraform

# Enable server-level auditing to Azure Storage
resource "azurerm_mssql_server_extended_auditing_policy" "<example_resource_name>" {
  server_id                  = "<example_resource_id>"
  storage_endpoint           = "https://<STORAGE_ACCOUNT_NAME>.blob.core.windows.net/" # Critical: audit log destination
  storage_account_access_key = "<STORAGE_ACCOUNT_KEY>"                                  # Critical: allows writing audit logs
}

NativeIaC

// Enable server-level auditing to an existing Storage Account
param sqlServerName string = "<example_resource_name>"
param storageAccountName string = "<example_resource_name>"

resource sql 'Microsoft.Sql/servers@2021-11-01' existing = {
  name: sqlServerName
}

resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

resource audit 'Microsoft.Sql/servers/auditingSettings@2021-11-01-preview' = {
  name: 'default'
  parent: sql
  properties: {
    state: 'Enabled' // Critical: turns on auditing
    storageEndpoint: 'https://${sa.name}.blob.core.windows.net/' // Critical: audit log destination
    storageAccountAccessKey: listKeys(sa.id, '2023-01-01').keys[0].value // Critical: grants write access to logs
  }
}

Other

1In Azure Portal, go to SQL servers and select your server
2Under Security, click Auditing
3Set Auditing to On
4Select Storage as the destination and choose a Storage account
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.sqlserver.sqlserver_client import sqlserver_client


class sqlserver_auditing_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, sql_servers in sqlserver_client.sql_servers.items():
            subscription_name = sqlserver_client.subscriptions.get(
                subscription, subscription
            )
            for sql_server in sql_servers:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=sql_server
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has an auditing policy configured."
                for auditing_policy in sql_server.auditing_policies:
                    if auditing_policy.state == "Disabled":
                        report.status = "FAIL"
                        report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) does not have any auditing policy configured."
                        break

                findings.append(report)

        return findings

References