Microsoft Defender for Cloud

Enable Microsoft Defender for SQL Servers on Machines

4 September 2026Doc update+7 / −3 lines

In brief

The article now uses updated metadata, clarifies that administrators should verify all machines are protected before enabling the plan, and adds a named anchor with a pluralized “Next steps” heading.

What Defender admins need to know

The clearer verification wording and anchor improve setup guidance and linking; no product configuration change is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Prerequisites

Before you enable the plan, make sure the following prerequisites are met:

Subscription permissions: To deploy the plan on a subscription, including Azure Policy, you need Subscription Owner permissions.
SQL Server instance permissions: SQL Server service accounts must be a member of the sysadmin fixed server role on each SQL Server instance, which is the default setting. Learn more about the SQL Server service account requirement.

Verify that your machines are protected

Depending on your environment, it can take a few hours to discover and protect SQL instances. As a final step, you should verify that all machines are protected.

Next stepsteps

[!div class="nextstepaction"] Verify that all machines are protected

@@ -2,7 +2,8 @@ title: Enable Microsoft Defender for SQL Servers on Machines description: Learn how to protect your Microsoft SQL Servers on Azure VMs, on-premises, and in hybrid and multicloud environments with Microsoft Defender for Cloud. ms.topic: how-to-ms.date: 09/21/2025+ms.date: 07/03/2026+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security administrator, I want to enable Defender for SQL servers on machines so that I can protect my SQL servers in various environments. ai-usage: ai-assisted ---@@ -19,6 +20,8 @@ The Defender for SQL Servers on Machines plan is one of the Defender for Databas  ## Prerequisites +Before you enable the plan, make sure the following prerequisites are met:+ - **Subscription permissions**: To deploy the plan on a subscription, including Azure Policy, you need **Subscription Owner** permissions.  - **SQL Server instance permissions**: SQL Server service accounts must be a member of the **sysadmin** fixed server role on each SQL Server instance, which is the default setting. Learn more about the [SQL Server service account requirement](/sql/sql-server/azure-arc/configure-least-privilege). @@ -114,11 +117,12 @@ To enable the plan on specific machines, you need to [disable the plan on the su ## Verify that your machines are protected  > [!IMPORTANT]->Don't skip this step, as it's important to verify your deployment is protected.+>Don't skip verifying that all machines are protected, as it's important to confirm your deployment is secure.  Depending on your environment, it can take a few hours to discover and protect SQL instances. As a final step, you should [verify that all machines are protected](verify-machine-protection.md). -## Next step+<a name="next-step"></a>+## Next steps  > [!div class="nextstepaction"] > [Verify that all machines are protected](verify-machine-protection.md)