Azure Compliance ControlsAzure Synapse Analytics
Synapse workspaces should have vulnerability assessment enabled
Checks Azure Synapse workspaces for configured recurring SQL vulnerability assessment scans. The control evaluates each Synapse workspace and determines whether the vulnerability assessment is enabled with a recurring scan setting in place.
What this control checks
Synapse workspaces must have vulnerability assessment enabled
Framework mappings
The clauses this control is mapped to in each framework.
- RA-5 Vulnerability Monitoring and Scanning
FedRAMP Moderate Baseline Rev 4
- RA-5: Vulnerability Scanning
- 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
- 3.11.3 Remediate vulnerabilities in accordance with risk assessments
- 3.3 Vulnerability Management
- RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
- RA.L2-3.11.3 Remediate vulnerabilities in accordance with risk assessments
- RA-5 Vulnerability Scanning
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
synapse_workspace_vulnerability_assessment_enabled - Checkov Check:
CKV2_AZURE_46 - Powerpipe Control:
azure_compliance.control.synapse_workspace_vulnerability_assessment_enabled - Azure Policy Definition:
0049a6b3-a662-4f3e-8635-39cf44ace45a
Last reviewed: 2026-10-15