Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled
Azure Defender for SQL servers on machines should be enabled. The Standard pricing tier must be set for SqlServerVirtualMachines. Defender for SQL surfaces and mitigates potential database vulnerabilities and detects anomalous activities.
Without Defender for SQL Server on Machines, attacks on SQL Server VMs can go undetected, including SQL injection, brute-force logons, and privilege abuse. This risks data exfiltration (C), schema or record tampering (I), and outages or ransomware impact (A), while reducing visibility and delaying response.
What this control checks
SqlServerVirtualMachines pricing must be Standard (On) for the subscription
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure Azure Defender for SQL servers on machines to be enabled" (50ea7265-7d8c-429e-9a7d-ca1f410191c3) and "Azure Defender for SQL servers on machines should be enabled" (6581d072-105e-4418-827f-bd446d56421b); Prowler checks defender_ensure_defender_for_databases_is_on (prowler azure --checks defender_ensure_defender_for_databases_is_on) and defender_ensure_defender_for_sql_servers_is_on (prowler azure --checks defender_ensure_defender_for_sql_servers_is_on).
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_79.
Framework-specific interpretation
SOC 2: Mapped to CC3.2 (COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks...), CC4.2 (COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those...), CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and 1 more clause.
ISO/IEC 27001:2022: Mapped to A.5.25 (Assessment And Decision On Information Security Events), A.8.7 (Protection Against Malware) and A.8.9 (Configuration Management).
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
NIST SP 800-53 Rev 5: Mapped to AC-16 (Security and Privacy Attributes), AC-2(12) (Account Monitoring for Atypical Usage), AU-12 (Audit Record Generation) and 8 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to ID.RA-01 (Vulnerabilities in assets are identified, validated, and recorded.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
- CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- A.5.25 Assessment and decision on information security events
- A.8.7 Protection against malware
- A.8.9 Configuration management
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- AC-2(12) Account Monitoring for Atypical Usage
- AC-16 Security and Privacy Attributes
- AU-6 Audit Record Review, Analysis, and Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
6 more clauses
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- IR-4 Incident Handling
- IR-5 Incident Monitoring
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
NIST Cybersecurity Framework v2.0
- ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.3.4 Alert in the event of an audit logging process failure
- 3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
- 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
6 more clauses
- 3.11.3 Remediate vulnerabilities in accordance with risk assessments
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 3.14.2 Provide protection from malicious code at designated locations within organizational systems
- 3.14.3 Monitor system security alerts and advisories and take action in response
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 9.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
- 8.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
RBI Cyber Security Framework for UCBs
- Annex I (6)
- 3.1.f Maker-checker
- 3.1.g Trails
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 2.4 Ensure that Azure Defender is set to On for SQL servers on machines
- 2.4 Ensure that Microsoft Defender for SQL servers on machines is set to 'On'
- 2.1.5 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
- 2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On'
- 2.1.5 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
- 2.1.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
- 3.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
- AC-2(12) Account Monitoring
- 164.308(a)(1)(ii)(A) Risk analysis
Related controls
- Azure subscriptions should have auto provisioning of the Log Analytics agent enabled
- Azure subscriptions should have Azure Defender for DNS enabled
- Azure SQL databases should have private endpoint connections enabled
- Microsoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selected
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_azure_defender_on_for_sqlservervm - Checkov Check:
CKV_AZURE_79 - Powerpipe Control:
azure_compliance.control.securitycenter_azure_defender_on_for_sqlservervm - Prowler Checks:
defender_ensure_defender_for_databases_is_on,defender_ensure_defender_for_sql_servers_is_on - Azure Policy Definitions:
50ea7265-7d8c-429e-9a7d-ca1f410191c3,6581d072-105e-4418-827f-bd446d56421b
Last reviewed: 2026-10-15