SQL servers should have VA 'Send scan reports to' configured
Azure SQL Server vulnerability assessment uses recurring scans and emails results to designated recipients. This control evaluates that VA is enabled and that Send scan reports to (or subscription admin notifications) is configured.
If VA reports aren't sent to responsible owners, findings can be missed, delaying fixes. Attackers may exploit misconfigurations, excessive permissions, or outdated settings, leading to data exposure (C), unauthorized changes (I), and potential service disruption (A).
What this control checks
SQL servers have the vulnerability assessment Send scan reports to setting configured
Common pitfalls
Subscription admins notification can satisfy the check
This evaluates that VA is enabled and that Send scan reports to (or subscription admin notifications) is configured so scan reports are delivered.
Audit evidence
Evidence that deployed resources meet this control: Prowler check sqlserver_va_scan_reports_configured (prowler azure --checks sqlserver_va_scan_reports_configured); PowerPipe control azure_compliance.control.sql_server_va_setting_scan_reports_configured.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 2.2.1 (The relevant entities shall regularly review the compliance with their policies on network and information system...) and 3.1.1 (For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and...).
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 3 Incident handling
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- 4.2.4 Ensure that VA setting Send scan reports to is configured for a SQL server
- 4.2.4 Ensure that VA setting 'Send scan reports to' is configured for a SQL server
- 4.2.4 Ensure that Vulnerability Assessment (VA) setting 'Send scan reports to' is configured for a SQL server
- 4.2.4 Ensure that Vulnerability Assessment (VA) setting 'Send scan reports to' is configured for a SQL server
- 164.308(a)(8) Evaluation
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_va_setting_scan_reports_configured - Powerpipe Control:
azure_compliance.control.sql_server_va_setting_scan_reports_configured - Prowler Check:
sqlserver_va_scan_reports_configured
Last reviewed: 2026-10-15