SQL servers should each have VA 'Also send email notifications to admins and subscription owners' configured
Checks the Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' for each SQL server. The setting must be enabled. Checkov CKV2_AZURE_5 looks at `email_subscription_admins`.
What this control checks
VA setting 'Also send email notifications to admins and subscription owners' is set for each SQL
Common pitfalls
Needs alert policy and VA resources
The check requires azurerm_mssql_server or azurerm_sql_server to be connected to an azurerm_mssql_server_security_alert_policy. The state attribute of azurerm_mssql_server_security_alert_policy must equal Enabled, and the policy must be connected to an azurerm_mssql_server_vulnerability_assessment.
Emails must also exist
The recurring_scans.*.email_subscription_admins attribute must equal true. The recurring_scans.*.emails attribute must exist.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.sql_server_va_setting_reports_notify_admins.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_5.
Framework-specific interpretation
CIS Azure Benchmark v1.3.0: Mapped to 4.2.5 (Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server).
CIS Azure Benchmark v1.4.0: Mapped to 4.2.5 (Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is...).
CIS Azure Benchmark v1.5.0: Mapped to 4.2.5 (Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is...).
CIS Azure Benchmark v2.0.0: Mapped to 4.2.5 (Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is...).
Framework mappings
The clauses this control is mapped to in each framework.
- 4.2.5 Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server
- 4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL server
- 4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL Server
- 4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL Server
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_va_setting_reports_notify_admins - Checkov Check:
CKV2_AZURE_5 - Powerpipe Control:
azure_compliance.control.sql_server_va_setting_reports_notify_admins
Last reviewed: 2026-10-15