Enable Vulnerability Assessment Periodic Recurring Scans

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access your Azure cloud resources.

03 From the Type equals all filter box, select Equals and choose SQL server to list only the SQL database servers provisioned for the selected Azure subscription.

04 Click on the name (link) of the SQL database server that you want to examine.

05 In the blade navigation panel, under Security, choose Microsoft Defender for Cloud.

06 On the Microsoft Defender for Cloud page, check the Enablement Status attribute value. If the Enablement Status value is set to Disabled, Microsoft Defender for Cloud and its Vulnerability Assessment (VA) Periodic Recurring Scans feature are not enabled for your SQL database server. If Enablement Status is not available, instead a Get Started page is displayed, Microsoft Defender for Cloud is disabled, therefore, Vulnerability Assessment Periodic Recurring Scans are also disabled for the selected SQL database server.

07 Repeat steps no. 4 – 6 for each SQL database server provisioned in the selected Azure subscription.

08 Repeat steps no. 3 – 7 for each subscription created in your Microsoft Azure cloud account.

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
  --query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
  --subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run account get-access-token command (Windows/macOS/Linux) with custom query filters to describe the name of the Microsoft Defender for Cloud pricing plan configured for the SQL database servers available within the current subscription:

az account get-access-token
  --query "{subscription:subscription,accessToken:accessToken}"
  --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pricings?api-version=2018-06-01' | jq '.|.value[] | select(.name=="SqlServers")'|jq '.properties.pricingTier'

05 The command output should return the name of the configured pricing tier:

"Free"

06 Repeat steps no. 3 - 5 for each subscription available in your Microsoft Azure cloud account.

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access your Azure cloud resources.

03 From the Type equals all filter box, select Equals and choose SQL server to list only the SQL database servers provisioned for the selected Azure subscription.

04 Click on the name (link) of the SQL database server that you want to examine.

05 In the blade navigation panel, under Security, select Microsoft Defender for Cloud.

06 On the Microsoft Defender for Cloud page, make sure that Microsoft Defender for SQL is enabled, then choose (Configure) next to Enablement Status: Enabled at the server-level/Enablement Status: Enabled at the subscription-level. If (Configure) is not available, instead a Get Started page is displayed, Microsoft Defender for Cloud is disabled, therefore, Periodic Recurring Scans are also disabled and the Audit process ends here. Otherwise, you can continue the Audit process with the next step.

07 On the Server settings configuration page, under VULNERABILITY ASSESSMENT SETTINGS, check the Periodic recurring scans configuration setting. If Periodic recurring scans is set to OFF, Vulnerability Assessment (VA) Periodic Recurring Scans are not enabled for the selected Microsoft SQL database server.

08 Repeat steps no. 4 – 7 for each SQL database server provisioned in the selected Azure subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Azure cloud account.

01 Run Get-AzSqlServer PowerShell command with custom output filters to list the name of each SQL database server and the name of its associated resource group, available within the current Azure subscription:

Get-AzSqlServer | Select-Object ServerName,ResourceGroupName

02 The command output should return the requested SQL database server information:

ServerName          ResourceGroupName
----------          -----------------
cc-prod-db-server   cloud-shell-storage-westeurope
cc-web-sql-server   cloud-shell-storage-westeurope

03 Run Get-AzSqlServerVulnerabilityAssessmentSetting command with the name of the SQL database server that you want to examine as the identifier parameter and custom output filters to determine if the Periodic Recurring Scans setting is enabled for the Vulnerability Assessment (VA) feature configured for the selected SQL database server:

Get-AzSqlServerVulnerabilityAssessmentSetting
-ServerName "cc-prod-db-server"
-ResourceGroupName "cloud-shell-storage-westeurope" | Select-Object RecurringScansInterval

04 The command output should return the requested configuration information:

RecurringScansInterval
----------------------
None

05 Repeat steps no. 3 and 4 for each SQL database server available within the current subscription.

06 Repeat steps no. 1 – 5 for each subscription created in your Azure cloud account.

01 Sign in to the Microsoft Azure Portal.

02 Navigate to Microsoft Defender for Cloud blade at https://portal.azure.com/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0.

03 In the left navigation panel, under Management, choose Environment settings.

04 Under Azure, click on the name (link) of the Azure subscription that you want to access.

05 In the left navigation panel, under Settings, choose Defender plans to access the Defender for Cloud pricing plans available for the selected Azure subscription.

06 Under Cloud Workload Protection (CWP), find the Databases pricing plan, and choose On from the Status column, to enable Microsoft Defender for Cloud for SQL database servers. Choose Save from the top menu to apply the configuration changes. This will automatically enable the Vulnerability Assessment (VA) Periodic Recurring Scans feature for your SQL database servers. With Express configuration, Periodic Recurring Scans are always active and scan scheduling is internal and not configurable.

07 Repeat step no. 4 – 6 for each subscription available within your Microsoft Azure cloud account.

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
  --query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) to set the selected Azure subscription to be the current active subscription (the command does not produce an output):

az account set
  --subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Define the configuration parameters for the account get-access-token command, where the "pricingTier" parameter value is set to "Standard" to turn on the Defender for Cloud pricing plan for Azure SQL database servers. Save the configuration document to a JSON file named enable-defender-for-sql-databases.json and replace the highlighted details, i.e. \<azure-subscription-id\>, with your own Azure account subscription ID:

{
	"id": "/subscriptions/<azure-subscription-id>/providers/Microsoft.Security/pricings/SqlServers",
	"name": "SqlServers",
	"type": "Microsoft.Security/pricings",
	"properties": {
		"pricingTier": "Standard"
	}
}

05 Run account get-access-token command (Windows/macOS/Linux) with the configuration document defined at the previous step (i.e. enable-defender-for-sql-databases.json file), to enable Microsoft Defender for Cloud for all the SQL database servers provisioned in the selected subscription. This will automatically enable the Vulnerability Assessment Periodic Recurring Scans feature for your SQL database servers. With Express configuration, Periodic Recurring Scans are always active and scan scheduling is internal and not configurable:

az account get-access-token
  --query "{subscription:subscription,accessToken:accessToken}"
  --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pricings/SqlServers?api-version=2018-06-01 -d@"enable-defender-for-sql-databases.json"'

06 The command output should return the information available for the enabled pricing tier:

{
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/providers/Microsoft.Security/pricings/SqlServers",
	"name": "SqlServers",
	"type": "Microsoft.Security/pricings",
	"properties": {
	"pricingTier": "Standard",
		"freeTrialRemainingTime": "PT0S"
	}
}

07 Repeat steps no. 3 - 6 for each subscription available in your Microsoft Azure cloud account.

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access your Azure cloud resources.

03 From the Type equals all filter box, select Equals and choose SQL server to list only the SQL database servers provisioned for the selected Azure subscription.

04 Click on the name (link) of the SQL database server that you want to configure.

05 In the blade navigation panel, under Security, select Microsoft Defender for Cloud.

06 On the Microsoft Defender for Cloud page, make sure that Microsoft Defender for SQL is enabled, then choose (Configure) next to Enablement Status: Enabled at the server-level/Enablement Status: Enabled at the subscription-level.

07 On the Server settings configuration page, under VULNERABILITY ASSESSMENT SETTINGS, perform the following actions:

1. Select ON under Periodic recurring scans to enable the Periodic Recurring Scans setting for the Vulnerability Assessment (VA) feature.
2. Choose Save to apply the configuration changes.

08 Repeat steps no. 4 – 7 for each SQL database server provisioned in the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created within your Azure cloud account.

01 Run Update-AzSqlServerVulnerabilityAssessmentSetting cmdlet with the name of the SQL server that you want to configure and the name of the associated resource group as the identifier parameters to enable Vulnerability Assessment (VA) Periodic Recurring Scans for the selected Microsoft SQL database server. Once the setting is enabled, the scans will be triggered automatically once a week. Replace the highlighted information, i.e. \<storage-account-name\> with the name of your Azure storage account:

Update-AzSqlServerVulnerabilityAssessmentSetting
-ServerName "cc-prod-db-server"
-ResourceGroupName "cloud-shell-storage-westeurope"
-StorageAccountName "<storage-account-name>"
-RecurringScansInterval Weekly

02 The command output should return the new Vulnerability Assessment (VA) settings:

ServerName               : cc-prod-db-server
ResourceGroupName        : cloud-shell-storage-westeurope
StorageAccountName       : <storage-account-name>
ScanResultsContainerName : vulnerability-assessment
RecurringScansInterval   : Weekly
EmailAdmins              : True
NotificationEmail        :

03 Repeat steps no. 1 and 2 for each SQL database server provisioned within the current Azure subscription.

04 Repeat steps no. 1 – 3 for each subscription in your Azure cloud account.