Back to Checks
azure

SQL Server has Vulnerability Assessment enabled and email notifications to subscription admins configured

sqlserver_va_emails_notifications_admins_enabled
Service: sqlserverSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.sql/servers

Azure SQL Server Vulnerability Assessment configuration, specifically whether recurring scans are set to email results to subscription admins/owners via Also send email notifications to admins and subscription owners.

Prowler logoProwlerprowler-provider-azure

Risk

Without these notifications, findings may go unnoticed, delaying fixes. Prolonged exposure of misconfigurations and weak permissions threatens data confidentiality and integrity, can affect availability, and slows incident response and audit readiness.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks sqlserver_va_emails_notifications_admins_enabled

Recommendation

Enable VA email alerts for admins/owners (Also send...) so findings reach accountable staff promptly.

  • Route to a monitored security group and SIEM
  • Review recipients regularly; remove stale accounts
  • Apply least privilege and maintain recurring scans for defense in depth

Remediation

CLI

az rest --method put --url "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Sql/servers/<SERVER_NAME>/vulnerabilityAssessments/default?api-version=2021-11-01" --body '{"properties":{"storageContainerPath":"https://<STORAGE_ACCOUNT>.blob.core.windows.net/<CONTAINER>","storageAccountAccessKey":"<STORAGE_KEY>","recurringScans":{"isEnabled":true,"emailSubscriptionAdmins":true}}}'

Terraform

# Enable VA at server level and email subscription admins
resource "azurerm_mssql_server_security_alert_policy" "<example_resource_name>" {
  server_id = "<example_resource_id>"
  state     = "Enabled"
}

resource "azurerm_mssql_server_vulnerability_assessment" "<example_resource_name>" {
  server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.<example_resource_name>.id
  storage_container_path          = "https://<example_resource_name>.blob.core.windows.net/<example_resource_name>" # Critical: required so the check detects VA configured
  storage_account_access_key      = "<example_resource_id>"

  recurring_scans {
    enabled                   = true
    email_subscription_admins = true # Critical: sends scan reports to subscription admins to PASS the check
  }
}

NativeIaC

// Enable VA at server level with classic storage and email to subscription admins
resource sqlServer 'Microsoft.Sql/servers@2021-11-01' existing = {
  name: '<example_resource_name>'
}

resource va 'Microsoft.Sql/servers/vulnerabilityAssessments@2021-11-01' = {
  name: 'default'
  parent: sqlServer
  properties: {
    storageContainerPath: 'https://<example_resource_name>.blob.core.windows.net/<example_resource_name>' // Critical: required so the check detects VA configured
    storageAccountAccessKey: '<example_resource_id>'
    recurringScans: {
      isEnabled: true
      emailSubscriptionAdmins: true // Critical: sends scan reports to subscription admins to PASS the check
    }
  }
}

Other

1In Azure Portal, go to SQL servers and open <SERVER_NAME>
2Under Security, select Vulnerability assessment (classic)
3Select a Storage account container and click Save (ensures a storage container path)
4Enable Recurring scans
5Enable Send scan reports to subscription admins
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.sqlserver.sqlserver_client import sqlserver_client


class sqlserver_va_emails_notifications_admins_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, sql_servers in sqlserver_client.sql_servers.items():
            subscription_name = sqlserver_client.subscriptions.get(
                subscription, subscription
            )
            for sql_server in sql_servers:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=sql_server
                )
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has vulnerability assessment disabled."
                if (
                    sql_server.vulnerability_assessment
                    and sql_server.vulnerability_assessment.storage_container_path
                ):
                    report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has vulnerability assessment enabled but no scan reports configured for subscription admins."
                    if (
                        sql_server.vulnerability_assessment.recurring_scans
                        and sql_server.vulnerability_assessment.recurring_scans.email_subscription_admins
                    ):
                        report.status = "PASS"
                        report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has vulnerability assessment enabled and scan reports configured for subscription admins."
                findings.append(report)

        return findings

References