SQL servers should have all threat detection types enabled
SQL Server can alert for security issues including SQL Injection, vulnerabilities, access anomalies and data exfiltration. Ensure none of these are disabled. SQL server threat detection should be enabled for all.
SQL Server can alert for security issues including SQL Injection, vulnerabilities, access anomalies and data exfiltration. Ensure none of these are disabled to benefit from the best protection.
What this control checks
azurerm_mssql_server_security_alert_policy must not list any disabled_alerts.
Common pitfalls
State Disabled also fails the check
KICS flags a policy with state set to Disabled.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.sql_server_threat_detection_all_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_25; KICS query "MSSQL Server Database With Alerts Disabled" (25cd1853-7e80-4106-9ac3-03f8636c25be); Trivy check AZU-0028.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_threat_detection_all_enabled - Checkov Check:
CKV_AZURE_25 - Powerpipe Control:
azure_compliance.control.sql_server_threat_detection_all_enabled - KICS Query:
25cd1853-7e80-4106-9ac3-03f8636c25be - Trivy Check:
AZU-0028
Last reviewed: 2026-10-15