Azure subscriptions should have Microsoft Defender for Databases enabled
Checks that Microsoft Defender for Databases is turned on. Prowler states Standard pricing must be enabled for `SqlServers`, `SqlServerVirtualMachines`, `OpenSourceRelationalDatabases`, and `CosmosDbs` in the Azure subscription.
Without this coverage, database workloads lack advanced threat detection, vulnerability assessment, and behavior analytics. Attacks like credential brute force, SQL injection, privilege abuse, and data exfiltration can go undetected, threatening confidentiality, integrity, and availability.
What this control checks
Checks Azure subscriptions against the Microsoft Defender for Databases requirement
Common pitfalls
Standard pricing needed for all four plan types
Standard pricing must be enabled for SqlServers, SqlServerVirtualMachines, OpenSourceRelationalDatabases, and CosmosDbs.
Runs within instances as IaaS, not PaaS
Instead of being enabled on services like Platform as a Service (PaaS), this implementation will run within your instances as Infrastructure as a Service (IaaS) on the Operating Systems hosting your databases.
Audit evidence
Evidence that deployed resources meet this control: Prowler check defender_ensure_defender_for_databases_is_on (prowler azure --checks defender_ensure_defender_for_databases_is_on); PowerPipe control azure_compliance.control.securitycenter_azure_defender_on_for_database.
Framework-specific interpretation
SOC 2: Mapped to CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
ISO/IEC 27001:2022: Mapped to A.5.25 (Assessment And Decision On Information Security Events), A.5.28 (Collection Of Evidence), A.8.7 (Protection Against Malware) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.25 Assessment and decision on information security events
- A.5.28 Collection of evidence
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
RBI Cyber Security Framework for UCBs
- Annex I (6)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On'
- 2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_database - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_database - Prowler Check:
defender_ensure_defender_for_databases_is_on
Last reviewed: 2026-10-14