Azure Compliance ControlsAzure SQL Database
Unprotected Azure SQL servers should have Azure Defender for SQL enabled
Azure SQL Server instances are evaluated for the server-level security alert policy of Microsoft Defender for SQL. The check expects the policy state to be Enabled. Prowler check sqlserver_microsoft_defender_enabled covers this.
What this control checks
Azure SQL Server security alert policy of Microsoft Defender for SQL must be Enabled.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- AC-16 Security and Privacy Attributes
- AU-6 Audit Record Review, Analysis, and Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
5 more clauses
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Monitoring and Scanning
- SI-4: System Monitoring
NIST Cybersecurity Framework v2.0
- ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.3.4 Alert in the event of an audit logging process failure
- 3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
- 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
3 more clauses
- 3.11.3 Remediate vulnerabilities in accordance with risk assessments
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 3.1.f Maker-checker
- 3.1.g Trails
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 4.2.1 Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers
- AU-6 Audit Record Review, Analysis And Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
4 more clauses
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Scanning
- SI-4 Information System Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_azure_defender_enabled - Powerpipe Control:
azure_compliance.control.sql_server_azure_defender_enabled - Prowler Check:
sqlserver_microsoft_defender_enabled
Last reviewed: 2026-10-15