Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Classic configuration vulnerability findings in Microsoft Defender for Cloud

4 September 2026RetirementAction required+37 / −76 lines

In brief

The documentation now states that APIs for classic vulnerability assessment configuration, along with classic Defender for SQL Advanced Threat Protection APIs, will be retired on August 16, 2027. It links to migration guidance.

What Defender admins need to know

Administrators using these APIs should migrate before the retirement date to avoid disruption.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Classic configuration vulnerability findings

in Microsoft Defender for Cloud provides

This article shows you how to view, remediate, and disable SQL vulnerability assessment findings when you use the classic configuration in Microsoft Defender for Cloud. You can review scan history, disable specific findings, and manage vulnerability assessments programmatically by using PowerShell, Azure CLI, or Resource Manager templates. For an overview of vulnerability assessments, see SQL vulnerability assessment.

Prerequisites

First, check whether you use the express or classic configuration.

To determinefind your configuration:configuration type:

  1. In the Azure portal, open the specificyour resource in Azure SQL Database, Azure SQL Managed Instance, or Azure Synapse.

  2. Under the Security, select Defender for Cloud.

  3. In Enablement Status, select Configure to open the Microsoft Defender for SQL settings,settings for the entire server,server or managed instance.

If the vulnerability settings show theyou see an option to configureset up a storage account, you're using use the classic configuration. Otherwise,If you don're usingt see a storage account option, you use the express configuration.

View scan history

Select Scan History in the vulnerability assessment pane to view previously run scans for the database.

Disable

Exempt specific findings from Microsoft Defender for Cloud (preview)

(recommendations)

IfNot all SQL VA findings might be relevant to your organization or configuration, and you needmight choose to ignore a finding rather than remediate it,them regardless of their status. To do this, you can disable it. Disabled findings don't affectcreate an exemption at the subscription or management group level so the recommendation no longer affects your secure score or generate noise.compliance for that scope.

When a finding matches your disable rules criteria, it doesn't appear in

Manage vulnerability assessments programmatically

You can manage vulnerability assessments programmatically by using Azure PowerShell, Azure CLI, or Resource Manager templates.

Manage vulnerability assessments with Azure PowerShell

| Update-AzSqlInstanceDatabaseVulnerabilityAssessmentSetting | Updates the vulnerability assessment settings of a managed database. | | Update-AzSqlInstanceVulnerabilityAssessmentSetting | Updates the vulnerability assessment settings of a managed instance. |

For a PowerShell script example,example that runs Azure SQL vulnerability assessments, see Azure SQL vulnerability assessment PowerShell support.

Manage vulnerability assessments with Azure CLI

You can use Azure CLI commands to manage your vulnerability assessments programmatically. The supported commands are:

|:-|:-| | az security va sql baseline delete | Delete SQL vulnerability assessment rule baseline. | | az security va sql baseline list | View SQL vulnerability assessment baseline for all rules. | | az security va sql baseline setaz security va sql baseline add | Sets SQL vulnerability assessmentSet baselines from the latest scan or from results supplied as JSON. This operation replaces the existing baseline. Replaces the current baseline.The deprecated baseline set command redirects to this operation. | | az security va sql baseline show | View SQL vulnerability assessment rule baseline. | | az security va sql baseline update | Update SQL vulnerability assessment rule baseline. Replaces the current rule baseline. | | az security va sql results list | View all SQL vulnerability assessment scan results. | | az security va sql scans list | List all SQL vulnerability assessment scan summaries. | | az security va sql scans show | View SQL vulnerability assessment scan summaries. |

Manage vulnerability assessments with Resource Manager templates

To configure vulnerability assessment baselines using Azure Resource Manager templates, use the Microsoft.Sql/servers/databases/vulnerabilityAssessments/rules/baselines type.

Ensure you have enabled vulnerabilityAssessments before you add baselines.

Here's an example thatThe following ARM template snippet defines Baseline Rulevulnerability assessment baseline resources for rules VA2065 forand VA1143 in the master database and VA1143 for the user database as resources in a Resource Manager template:databases:

   "resources": [
- Master database - "name": "[concat(parameters('server_name'),'/', parameters('database_name'), '/default/VA2065/<b>master</b>')]",
- User database - "name": "[concat(parameters('server_name'),'/', parameters('database_name'), '/default/VA2065/<b>default</b>')]",

To handle Boolean types as true/false, set the baseline result with binary input like "1"/"0". The following example shows a baseline resource that uses a binary value for rule VA1143:

```json
   {
## Related content

- [Microsoft Defender for Azure SQL](defender-for-sql-introduction.md)
- [Data discovery and classification for Azure SQL]classification](/azure/azure-sql/database/data-discovery-and-classification-overview)
- [Store vulnerability assessment scan results in a storage account behind firewalls and VNets](/azure/azure-sql/database/sql-database-vulnerability-assessment-storage)
- [Common questions about Azure SQL databases](faq-defender-for-databases.yml)