Back to Checks
azure

SQL Server has Microsoft Defender for SQL enabled

sqlserver_microsoft_defender_enabled
Service: sqlserverSeverity: high
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:microsoft.sql/servers

Azure SQL Server instances are evaluated for the server-level security alert policy of Microsoft Defender for SQL, expecting the policy state to be Enabled.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender for SQL, anomalous logins, SQL injection patterns, and risky configurations may go undetected, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and disruptive queries or ransomware (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks sqlserver_microsoft_defender_enabled

Recommendation

Enable Microsoft Defender for SQL across all servers and managed instances, preferably at subscription scope. Apply least privilege, restrict public exposure, and integrate alerts with your SOC. Regularly review vulnerability assessment results and harden findings as part of defense in depth.

Remediation

CLI

az rest --method PUT --url "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Sql/servers/<SERVER_NAME>/securityAlertPolicies/Default?api-version=2023-08-01-preview" --body '{"properties":{"state":"Enabled"}}'

Terraform

resource "azurerm_mssql_server_security_alert_policy" "<example_resource_name>" {
  server_id = "<example_resource_id>"
  state     = "Enabled" # Critical: enables the server's security alert policy (Defender for SQL)
}

NativeIaC

param serverName string = '<example_resource_name>'

resource securityAlert 'Microsoft.Sql/servers/securityAlertPolicies@2021-11-01' = {
  name: '${serverName}/Default'
  properties: {
    state: 'Enabled' // Critical: enables the server's security alert policy (Defender for SQL)
  }
}

Other

1Sign in to the Azure portal > SQL servers > select <SERVER_NAME>
2Under Security, select Microsoft Defender for SQL (or Microsoft Defender for Cloud)
3Toggle to On (Enable) and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.sqlserver.sqlserver_client import sqlserver_client


class sqlserver_microsoft_defender_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, sql_servers in sqlserver_client.sql_servers.items():
            subscription_name = sqlserver_client.subscriptions.get(
                subscription, subscription
            )
            for sql_server in sql_servers:
                if sql_server.security_alert_policies:
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=sql_server
                    )
                    report.subscription = subscription
                    report.status = "FAIL"
                    report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has microsoft defender disabled."
                    if sql_server.security_alert_policies.state == "Enabled":
                        report.status = "PASS"
                        report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has microsoft defender enabled."
                    findings.append(report)

        return findings

References