SQL servers should have auditing enabled
Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log. Prowler assesses auditing at the server level to confirm audit logging is active.
Without SQL auditing, visibility into logins, privilege changes, and query activity is lost. Stealthy data exfiltration and tampering can go undetected, impacting confidentiality and integrity. Absent audit trails hinder forensics, slow incident response, and weaken compliance evidence.
What this control checks
Fails SQL servers whose auditing policy state is Disabled
Common pitfalls
Retention must be greater than 90 days
Prowler sqlserver_auditing_retention_90_days evaluates that auditing is enabled and log retention is greater than 90 days. It considers the auditing policy state and the configured retention_days value.
Analytics servers are excluded from the policy
The Azure Policy applies to Microsoft.Sql/servers where kind does not contain analytics.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Auditing on SQL server should be enabled" (a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9); Prowler checks sqlserver_auditing_enabled (prowler azure --checks sqlserver_auditing_enabled) and sqlserver_auditing_retention_90_days (prowler azure --checks sqlserver_auditing_retention_90_days); PowerPipe control azure_compliance.control.sql_server_auditing_on.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 10.2.1 (Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of...), 10.2.1.1 (Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of...), 10.2.1.2 (Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of...) and 7 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 3.2.5 (The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised...), 4.1.2.g (required resources, including backups and redundancies;) and 4 more clauses.
NIST SP 800-53 Rev 5: Mapped to AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail), AU-6(4) (Central Review and Analysis) and 1 more clause.
FedRAMP Moderate Baseline Rev 4: Mapped to AU-12 (Audit Generation).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
5 more clauses
- 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
FedRAMP Moderate Baseline Rev 4
- AU-12 Audit Generation
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 4.1.1 Ensure that 'Auditing' is set to 'On'
- 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- 5.1.1 Ensure that 'Auditing' is set to 'On'
- 5.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- 1211.09aa3System.4-09.aa 09.10 Monitoring
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.308(a)(5)(ii)(C) Log-in monitoring
- 164.308(a)(6)(ii): Administrative Safeguards
- 164.312(b) Audit controls
- 10.5.4 Logs for external-facing technologies (for example, wireless, firewalls, DNS, mail) are written onto a secure, centralized, internal log server or media
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_auditing_on - Powerpipe Control:
azure_compliance.control.sql_server_auditing_on - Prowler Checks:
sqlserver_auditing_enabled,sqlserver_auditing_retention_90_days - Azure Policy Definition:
a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9
Last reviewed: 2026-10-15