Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled
Azure Defender for SQL provides functionality for surfacing and mitigating potential database vulnerabilities, detecting anomalous activities that could indicate threats to SQL databases, and discovering and classifying sensitive data. The plan must be enabled.
Without Defender for SQL, attacks like SQL injection, brute-force logins, and anomalous queries may go undetected, enabling data exfiltration and tampering. Limited telemetry delays incident response, risking loss of confidentiality and integrity and aiding lateral movement.
What this control checks
Microsoft.Security/pricings SqlServers must have pricingTier Standard on the subscription.
Common pitfalls
Non-standard tiers mean the plan is not enabled
Non-standard tiers indicate the plan isn't enabled.
Check passes for non-SqlServers or Standard tier
The check supports azurerm_security_center_subscription_pricing. It passes when resource_type is not SqlServers or tier is Standard.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Azure Defender for Azure SQL Database servers should be enabled" (7fe3b40f-802b-4cdd-8bd4-fd799c948cc2) and "Configure Azure Defender for Azure SQL database to be enabled" (b99b73e7-074b-4089-9395-b7236f094491); Prowler checks defender_ensure_defender_for_azure_sql_databases_is_on (prowler azure --checks defender_ensure_defender_for_azure_sql_databases_is_on) and defender_ensure_defender_for_databases_is_on (prowler azure --checks defender_ensure_defender_for_databases_is_on); PowerPipe control azure_compliance.control.securitycenter_azure_defender_on_for_sqldb.
Framework-specific interpretation
SOC 2: Mapped to CC3.2 (COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks...), CC4.2 (COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those...), CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and 1 more clause.
ISO/IEC 27001:2022: Mapped to A.5.25 (Assessment And Decision On Information Security Events), A.8.7 (Protection Against Malware) and A.8.9 (Configuration Management).
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
NIST SP 800-53 Rev 5: Mapped to AC-2(12) (Account Monitoring for Atypical Usage), AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail) and 7 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to GV.RM-03 (Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.) and ID.RA-01 (Vulnerabilities in assets are identified, validated, and recorded.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
- CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.25 Assessment and decision on information security events
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- AC-2(12) Account Monitoring for Atypical Usage
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
5 more clauses
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- SI-4: System Monitoring
NIST Cybersecurity Framework v2.0
- GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
- ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.3.4 Alert in the event of an audit logging process failure
- 3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
- 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
6 more clauses
- 3.11.3 Remediate vulnerabilities in accordance with risk assessments
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 3.14.2 Provide protection from malicious code at designated locations within organizational systems
- 3.14.3 Monitor system security alerts and advisories and take action in response
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 9.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'
- 8.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'
RBI Cyber Security Framework for UCBs
- Annex I (6)
- 3.1.f Maker-checker
- 3.1.g Trails
- 4.4.a IT Operations
- 4.4.b IT Operations
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 2.3 Ensure that Azure Defender is set to On for Azure SQL database servers
- 2.3 Ensure that Microsoft Defender for Azure SQL Databases is set to 'On'
- 2.1.4 Ensure That Microsoft Defender for Azure SQL Databases Is Set To 'On'
- 2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On'
- 2.1.4 Ensure That Microsoft Defender for Azure SQL Databases Is Set To 'On'
- 2.1.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'
- 3.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'
- AC-2(12) Account Monitoring
- AU-6 Audit Record Review, Analysis And Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
6 more clauses
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Scanning
- SI-2 Flaw Remediation
- SI-4 Information System Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_sqldb - Checkov Check:
CKV_AZURE_69 - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_sqldb - Prowler Checks:
defender_ensure_defender_for_azure_sql_databases_is_on,defender_ensure_defender_for_databases_is_on - Azure Policy Definitions:
7fe3b40f-802b-4cdd-8bd4-fd799c948cc2,b99b73e7-074b-4089-9395-b7236f094491
Last reviewed: 2026-10-15