Back to Checks
azure

SQL server has vulnerability assessment enabled with storage container configured

sqlserver_vulnerability_assessment_enabled
Service: sqlserverSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.sql/servers

Azure SQL Server has Vulnerability Assessment configured with a defined location to persist assessment reports and scan results

Prowler logoProwlerprowler-provider-azure

Risk

Without Vulnerability Assessment, misconfigurations and excessive permissions can go unnoticed.

Adversaries may exploit weak server or database settings to escalate privileges, exfiltrate data, or alter records, degrading confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks sqlserver_vulnerability_assessment_enabled

Recommendation

Enable and standardize Vulnerability Assessment across SQL servers and databases, retaining scan results in a secure repository. Run scans routinely, review findings, set baselines, and remediate promptly. Apply least privilege to report access and integrate results into change management for defense in depth.

Remediation

CLI

Update-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName <RESOURCE_GROUP> -ServerName <SERVER_NAME> -StorageAccountName <STORAGE_ACCOUNT_NAME> -ScanResultsContainerName <CONTAINER_NAME>

Terraform

# Enable server security alert policy (required by VA)
resource "azurerm_mssql_server_security_alert_policy" "<example_resource_name>" {
  resource_group_name = "<example_resource_name>"
  server_name         = "<example_resource_name>"
  state               = "Enabled"
}

# Configure VA (classic) with storage container
resource "azurerm_mssql_server_vulnerability_assessment" "<example_resource_name>" {
  server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.<example_resource_name>.id
  storage_container_path          = "https://<example_resource_name>.blob.core.windows.net/<example_resource_name>" # CRITICAL: sets storage container path so the check passes
  storage_account_access_key      = "<example_resource_name>"
}

NativeIaC

// Configure VA (classic) at the SQL Server level
resource sqlServerVA 'Microsoft.Sql/servers/vulnerabilityAssessments@2021-11-01' = {
  name: '<example_resource_name>/default'
  properties: {
    storageContainerPath: 'https://<example_resource_name>.blob.core.windows.net/<example_resource_name>' // CRITICAL: sets the storage container path to enable VA
  }
}

Other

1In the Azure portal, go to SQL servers and open <SERVER_NAME>
2Under Security, select Microsoft Defender for SQL (or Defender for Cloud > Microsoft Defender for SQL)
3In Vulnerability assessment settings, click Configure
4Select the Storage account and the target Container
5Save
6Verification: Open the server's Vulnerability assessment blade and confirm a storage container is shown.

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.sqlserver.sqlserver_client import sqlserver_client


class sqlserver_vulnerability_assessment_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, sql_servers in sqlserver_client.sql_servers.items():
            subscription_name = sqlserver_client.subscriptions.get(
                subscription, subscription
            )
            for sql_server in sql_servers:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=sql_server
                )
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has vulnerability assessment disabled."
                if (
                    sql_server.vulnerability_assessment
                    and sql_server.vulnerability_assessment.storage_container_path
                    is not None
                ):
                    report.status = "PASS"
                    report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has vulnerability assessment enabled."
                findings.append(report)

        return findings

References