SQL servers should each have VA 'Also send email notifications to admins and subscription owners' configured
Checks the Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' for each SQL server. The setting must be enabled. Checkov CKV2_AZURE_5 looks at `email_subscription_admins`.
What this control checks
Checkov CKV2_AZURE_5 checks that azurerm_mssql_server or azurerm_sql_server is connected to an azurerm_mssql_server_security_alert_policy whose state equals Enabled. Checkov CKV2_AZURE_5 checks that this policy is connected to an azurerm_mssql_server_vulnerability_assessment. Checkov CKV2_AZURE_5 checks that recurring_scans.*.email_subscription_admins equals true on the azurerm_mssql_server_vulnerability_assessment. Checkov CKV2_AZURE_5 checks that recurring_scans.*.emails exists on the azurerm_mssql_server_vulnerability_assessment.
Framework mappings
The clauses this control is mapped to in each framework.
- 4.2.5 Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server
- 4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL server
- 4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL Server
- 4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL Server
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_va_setting_reports_notify_admins - Checkov Check:
CKV2_AZURE_5 - Powerpipe Control:
azure_compliance.control.sql_server_va_setting_reports_notify_admins
Last reviewed: 2026-10-15