Synapse workspaces should have vulnerability assessment enabled
Checks Azure Synapse workspaces for configured recurring SQL vulnerability assessment scans. The control evaluates each Synapse workspace and determines whether the vulnerability assessment is enabled with a recurring scan setting in place.
Discover, track, and remediate potential vulnerabilities by configuring recurring SQL vulnerability assessment scans on your Synapse workspaces.
What this control checks
Synapse workspaces must have vulnerability assessment enabled
Common pitfalls
Needs a connected security alert policy
Checkov CKV2_AZURE_46 requires azurerm_synapse_workspace_vulnerability_assessment to be connected to azurerm_synapse_workspace_security_alert_policy. The azurerm_synapse_workspace_security_alert_policy must be connected to azurerm_synapse_workspace.
Recurring scans must be enabled
The attribute recurring_scans.*.enabled must equal true.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Vulnerability assessment should be enabled on your Synapse workspaces" (0049a6b3-a662-4f3e-8635-39cf44ace45a); PowerPipe control azure_compliance.control.synapse_workspace_vulnerability_assessment_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_46.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to RA-5 (Vulnerability Monitoring and Scanning).
FedRAMP Moderate Baseline Rev 4: Mapped to RA-5 (Vulnerability Scanning).
Framework mappings
The clauses this control is mapped to in each framework.
- RA-5 Vulnerability Monitoring and Scanning
FedRAMP Moderate Baseline Rev 4
- RA-5: Vulnerability Scanning
- 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
- 3.11.3 Remediate vulnerabilities in accordance with risk assessments
- 3.3 Vulnerability Management
- RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
- RA.L2-3.11.3 Remediate vulnerabilities in accordance with risk assessments
- RA-5 Vulnerability Scanning
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
synapse_workspace_vulnerability_assessment_enabled - Checkov Check:
CKV2_AZURE_46 - Powerpipe Control:
azure_compliance.control.synapse_workspace_vulnerability_assessment_enabled - Azure Policy Definition:
0049a6b3-a662-4f3e-8635-39cf44ace45a
Last reviewed: 2026-10-15