Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Express configuration vulnerability findings

4 September 2026Doc update+18 / −13 lines

In brief

The article now clarifies how to identify classic versus express configuration, adds explicit Azure portal steps for scan history and rules, and improves headings, wording, and section links.

What Defender admins need to know

Administrators can use the clearer instructions to identify their configuration model and navigate vulnerability assessment tasks.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Express configuration vulnerability findings in Microsoft Defender for Cloud

Microsoft Defender for Cloud provides vulnerability assessment for your Azure SQL databases. Scans detect software vulnerabilities and return findings. You can remediate vulnerabilities or disable findings when needed.

Prerequisites

Before you begin, confirm which configuration model your environment uses.

  • Make sure you know whether you're using the express or classic configuration models before you continue.

    To see which configuration you're using:

    1. Under the Security heading, select Defender for Cloud.
    2. In the Enablement Status, select Configure to open the Microsoft Defender for SQL settings pane for either the entire server or managed instance.

    If the vulnerability settings show the option to configure a storage account, you're using the classic configuration. If not,the vulnerability settings don't show the option to configure a storage account, you're using the express configuration.

Express configuration

View scan history

In the Azure portal, open your database resource and select Defender for Cloud under Security to open the vulnerability assessment pane. Select Scan History to view a history of all scans previously run on this database.

Express configuration doesn't store scan results if they're identical to previous scans. The scan time shown in the scan history is the time of the last scan where the scan results changed.

Disable specific findings from Microsoft Defender for Cloud (preview)

If you have an organizational need to ignore a finding rather than remediate it, you can disable the finding. Disabled findings don't impact your secure score or generate unwanted noise. You can see disabled findings in the "Not applicable" section of the scan results.

When a finding matches the criteria you've defined in your disable rules, it won't appear in the list of findings. Typical scenarios might include:

To create a rule:rule, go to Microsoft Defender for Cloud in the Azure portal and select Recommendations to find the relevant recommendation.

  1. From the recommendations detail page for Vulnerability assessment findings on your SQL servers on machines should be remediated, select Disable rule.

  2. Select the relevant scope.

  3. Select Disable rule.

  4. From the scope list, subscriptions with active rules show as Rule applied.

  5. To view or delete the rule,a rule for that scope, select the ellipsis menu ("...").

Configure email notifications using Azure Logic Apps

To receive regular updates of the vulnerability assessment status for your database, you can use the customizable Azure Logic Apps template.

Using thisthe customizable Azure Logic Apps template lets you:

  • Choose the timing of the email reports.
  • Have a consistent view of your vulnerability assessment status that includes disabled rules.

To configure vulnerability assessment baselines by using Azure Resource Manager templates, use the Microsoft.Sql/servers/databases/sqlVulnerabilityAssessments/baselines type. Make sure that vulnerabilityAssessments is enabled before you add baselines.

Here are severalThe following examples toshow how you canto set up baselines using ARM templates:

  • Setup batch baseline based on latest scan results:

Manage vulnerability assessments with PowerShell

Express configuration isn't supported in PowerShell cmdlets, but you can use PowerShell to invoke the latest vulnerability assessment capabilities by using the REST API. For example, you can:

Manage vulnerability assessments with Azure CLI

Invoke express configuration by using Azure CLI commands for express configuration.