Azure subscriptions should have Microsoft Defender for open-source relational databases enabled
Azure Defender for open-source relational databases detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. The Standard pricing tier must be enabled at the subscription level.
Absent the Standard plan, open-source databases lack threat detection and behavior analytics, reducing confidentiality and integrity. SQL injection, brute-force logins, and data exfiltration may go unnoticed, delaying response and enabling lateral movement.
What this control checks
Checks the Azure subscription's Defender plan setting for open-source relational databases
Common pitfalls
Enabling this plan will result in charges
Important: Enabling this plan will result in charges for protecting your open-source relational databases.
Databases check needs Standard for four plans
Standard pricing must be enabled for SqlServers, SqlServerVirtualMachines, OpenSourceRelationalDatabases, and CosmosDbs.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Azure Defender for open-source relational databases should be enabled" (0a9fbe0d-c5c4-4da8-87d8-f4fd77338835) and "Configure Azure Defender for open-source relational databases to be enabled" (44433aa3-7ec2-4002-93ea-65c65ff0310a); Prowler checks defender_ensure_defender_for_databases_is_on (prowler azure --checks defender_ensure_defender_for_databases_is_on) and defender_ensure_defender_for_os_relational_databases_is_on (prowler azure --checks defender_ensure_defender_for_os_relational_databases_is_on); PowerPipe control azure_compliance.control.securitycenter_azure_defender_on_for_opensource_relational_db.
Framework-specific interpretation
SOC 2: Mapped to CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
ISO/IEC 27001:2022: Mapped to A.5.25 (Assessment And Decision On Information Security Events), A.5.28 (Collection Of Evidence), A.8.7 (Protection Against Malware) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
NIST Cybersecurity Framework v2.0: Mapped to ID.RA-03 (Internal and external threats to the organization are identified and recorded.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.25 Assessment and decision on information security events
- A.5.28 Collection of evidence
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
NIST Cybersecurity Framework v2.0
- ID.RA-03: Internal and external threats to the organization are identified and recorded.
- 9.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
- 8.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
RBI Cyber Security Framework for UCBs
- Annex I (6)
- 3.1.f Maker-checker
- 3.1.g Trails
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 2.1.6 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
- 2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On'
- 2.1.6 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
- 2.1.5 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
- 3.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_opensource_relational_db - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_opensource_relational_db - Prowler Checks:
defender_ensure_defender_for_databases_is_on,defender_ensure_defender_for_os_relational_databases_is_on - Azure Policy Definitions:
0a9fbe0d-c5c4-4da8-87d8-f4fd77338835,44433aa3-7ec2-4002-93ea-65c65ff0310a
Last reviewed: 2026-10-15