Azure Compliance ControlsAzure SQL Database
Critical SQL servers should have Microsoft Defender for SQL set to 'On'
Checks that Microsoft Defender for SQL is enabled on Azure SQL servers. The Prowler check evaluates the server-level security alert policy, expecting the policy state to be `Enabled`. The Azure Policy audits SQL servers without Advanced Data Security.
What this control checks
Server-level security alert policy state must be Enabled for Microsoft Defender for SQL
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
FedRAMP Moderate Baseline Rev 4
- AU-6 Audit Record Review, Analysis And Reporting
- AU-12 Audit Generation
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5: Vulnerability Scanning
1 more clause
- SI-4: Information System Monitoring
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 4.2.1 Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled'
- 4.2.1 Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled'
- 4.2.1 Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers
- 4.2.1 Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU.L2-3.3.4 Alert in the event of an audit logging process failure
- AU.L2-3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
- RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
3 more clauses
- RA.L2-3.11.3 Remediate vulnerabilities in accordance with risk assessments
- SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- SI.L2-3.14.7 Identify unauthorized use of organizational systems
Related controls
- Azure subscriptions should have Microsoft Defender for Containers enabled
- ASC Default policy settings should not have any setting set to 'Disabled'
- SQL servers should have a Microsoft Entra ID admin configured
- Azure SQL databases should have long-term geo-redundant backup enabled
- Security contacts should have attack path email notifications enabled at the configured minimum risk level
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_atp_enabled - Powerpipe Controls:
azure_compliance.control.sql_server_atp_enabled,azure_compliance.control.sql_server_azure_defender_enabled - Prowler Check:
sqlserver_microsoft_defender_enabled - Azure Policy Definition:
abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9
Last reviewed: 2026-10-15