Critical SQL servers should have Microsoft Defender for SQL set to 'On'
Checks that Microsoft Defender for SQL is enabled on Azure SQL servers. The Prowler check evaluates the server-level security alert policy, expecting the policy state to be `Enabled`. The Azure Policy audits SQL servers without Advanced Data Security.
Without Defender for SQL, anomalous logins, SQL injection patterns, and risky configurations may go undetected, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and disruptive queries or ransomware (availability).
What this control checks
Server-level security alert policy state must be Enabled for Microsoft Defender for SQL
Common pitfalls
Servers of kind analytics are not evaluated
The policy rule applies to Microsoft.Sql/servers where kind does not contain analytics.
Policy effect can be Disabled
The effect parameter defaults to AuditIfNotExists. The allowed values are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Defender for SQL should be enabled for unprotected Azure SQL servers" (abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9); Prowler check sqlserver_microsoft_defender_enabled (prowler azure --checks sqlserver_microsoft_defender_enabled); PowerPipe controls azure_compliance.control.sql_server_atp_enabled and azure_compliance.control.sql_server_azure_defender_enabled.
Framework-specific interpretation
SOC 2: Mapped to CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
FedRAMP Moderate Baseline Rev 4: Mapped to AU-12 (Audit Generation), AU-6 (Audit Record Review, Analysis And Reporting), IR-4 (Incident Handling) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
FedRAMP Moderate Baseline Rev 4
- AU-6 Audit Record Review, Analysis And Reporting
- AU-12 Audit Generation
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5: Vulnerability Scanning
1 more clause
- SI-4: Information System Monitoring
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 4.2.1 Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled'
- 4.2.1 Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled'
- 4.2.1 Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers
- 4.2.1 Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU.L2-3.3.4 Alert in the event of an audit logging process failure
- AU.L2-3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
- RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
3 more clauses
- RA.L2-3.11.3 Remediate vulnerabilities in accordance with risk assessments
- SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- SI.L2-3.14.7 Identify unauthorized use of organizational systems
Related controls
- Azure subscriptions should have Microsoft Defender for Containers enabled
- ASC Default policy settings should not have any setting set to 'Disabled'
- SQL servers should have a Microsoft Entra ID admin configured
- Azure SQL databases should have long-term geo-redundant backup enabled
- Security contacts should have attack path email notifications enabled at the configured minimum risk level
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_atp_enabled - Powerpipe Controls:
azure_compliance.control.sql_server_atp_enabled,azure_compliance.control.sql_server_azure_defender_enabled - Prowler Check:
sqlserver_microsoft_defender_enabled - Azure Policy Definition:
abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9
Last reviewed: 2026-10-15