SQL managed instances should have vulnerability assessment enabled

Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.

Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities.

What this control checks

Each SQL Managed Instance must have recurring vulnerability assessment scans enabled.

Common pitfalls

Policy needs a assessments resource to exist

The azure_policy check looks for a Microsoft.Security/assessments resource whose id is like /databases/*/providers/Microsoft.Security/assessments/1a56a8c1-e013-49d0-8295-e60407730b94.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Vulnerability assessment should be enabled on SQL Managed Instance" (1b7aa243-30e4-4c9e-bca8-d0d3022b634a); PowerPipe control azure_compliance.control.mssql_managed_instance_vulnerability_assessment_enabled.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to RA-5 (Vulnerability Monitoring and Scanning).

FedRAMP Moderate Baseline Rev 4: Mapped to RA-5 (Vulnerability Scanning).

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

RA-5 Vulnerability Monitoring and Scanning

FedRAMP Moderate Baseline Rev 4

RA-5: Vulnerability Scanning

NIST SP 800-171 Rev 2

3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
3.11.3 Remediate vulnerabilities in accordance with risk assessments

RBI IT Framework for NBFCs

1 IT Governance
3.3 Vulnerability Management

CMMC 2.0 Level 2

RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
RA.L2-3.11.3 Remediate vulnerabilities in accordance with risk assessments

FedRAMP High

RA-5 Vulnerability Scanning

HIPAA HITRUST v9.2

0709.10m1Organizational.1-10.m 10.06 Technical Vulnerability Management
0710.10m2Organizational.1-10.m 10.06 Technical Vulnerability Management
0719.10m3Organizational.5-10.m 10.06 Technical Vulnerability Management

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: mssql_managed_instance_vulnerability_assessment_enabled
Powerpipe Control: azure_compliance.control.mssql_managed_instance_vulnerability_assessment_enabled
Azure Policy Definition: 1b7aa243-30e4-4c9e-bca8-d0d3022b634a

Last reviewed: 2026-10-13

View all Azure controls →