Azure Compliance ControlsAzure SQL Database
SQL servers should have auditing enabled
Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log. Prowler assesses auditing at the server level to confirm audit logging is active.
What this control checks
Fails SQL servers whose auditing policy state is Disabled
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
5 more clauses
- 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
FedRAMP Moderate Baseline Rev 4
- AU-12 Audit Generation
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 5.1.1 Ensure that 'Auditing' is set to 'On'
- 5.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- 1211.09aa3System.4-09.aa 09.10 Monitoring
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.308(a)(5)(ii)(C) Log-in monitoring
- 164.308(a)(6)(ii): Administrative Safeguards
- 164.312(b) Audit controls
- 10.5.4 Logs for external-facing technologies (for example, wireless, firewalls, DNS, mail) are written onto a secure, centralized, internal log server or media
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_auditing_on - Powerpipe Control:
azure_compliance.control.sql_server_auditing_on - Prowler Checks:
sqlserver_auditing_enabled,sqlserver_auditing_retention_90_days - Azure Policy Definition:
a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9
Last reviewed: 2026-10-15