Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Scan for vulnerabilities on SQL servers

4 September 2026Doc update+17 / −63 lines

In brief

The article updates guidance for reviewing SQL vulnerability assessment findings from Defender for Cloud or an individual resource page. It adds modern and legacy experience guidance, explains baselines, and directs administrators to use recommendation exemptions for findings they choose to ignore.

What Defender admins need to know

Use the updated guidance when reviewing findings and managing baselines or exemptions. No required administrator action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • The scan is lightweight, safe, takes only a few seconds per database, and is entirely read-only. It does not make any changes to your database.
  • Execute permissions on the following stored procedures are required for some of the vulnerability assessment rules to run correctly: xp_instance_regread, sysmail_help_profile_sp.

Explore vulnerability assessment reportsfindings

The vulnerability assessment service scans your databases every 12 hours.

The vulnerability assessment dashboard provides an overview of assessment results across all your databases. It also summarizes healthy and unhealthy databases and failing checks by risk distribution.

You can view the vulnerability assessment results directly from Defender for Cloud.

  1. From Defender for Cloud's sidebar, open or the Recommendationsindividual resource page.

  2. Select the recommendation SQL servers on machines should have vulnerability findings resolved. For more information, see the Defender for Cloud recommendations reference page.

    :::image type="content" source="./media/security-center-advanced-iaas-data/data-and-storage-sqldb-vulns-on-vm.png" alt-text="Screenshot of recommendation cardThe article Review and remediate vulnerabilities provides detailed guidance for working with SQL servers on machines should have vulnerability findings resolved in Defender for Cloud.":::assessment scan results.

    The detailed view for the SQL servers vulnerability recommendation appears.

    :::image type="content" source="./media/defender-for-sql-on-machines-vulnerability-assessment/sql-vulnerability-findings.png" alt-text="Screenshot of recommendation details view for SQL servers on machines showing vulnerability findings.":::

  3. Check out additional information about the recommendation:

    • For an overview of scanned resources (databases) and the list of security checks that were tested, open the Affected resources and select the server of interest.

    • For an overview of the vulnerabilities grouped by a specific SQL database, select the database of interest.

    In each view, the security checks are sorted by Severity. Select a specific security check to see a details pane with a Description, how to Remediate it, and other related information such as Impact or Benchmark.

Set a baseline

As you review SQL vulnerability assessment results, you can mark specific findings as an acceptable baseline in your environment. A baseline customizes how results are reported. Results that match the baseline are considered passing in later scans. After you establish a baseline security state, the vulnerability assessment scanner reports only deviations from that baseline so you can focus on relevant issues.

Modern recommendations experience:

:::image type="content" source="media/defender-for-sql-on-machines-vulnerability-assessment/set-sql-vulnerability-assessment-baseline.png" alt-text="Screenshot of a SQL Vulnerability Assessment recommendation with Manage query results and remediation and Add all results as baseline highlighted." lightbox="media/defender-for-sql-on-machines-vulnerability-assessment/set-sql-vulnerability-assessment-baseline.png":::

Legacy findings experience:

:::image type="content" source="media/defender-for-sql-on-machines-vulnerability-assessment/analyze-report-for-details.png" alt-text="Screenshot of vulnerability assessment results page where you can mark findings as an acceptable baseline for your environment.":::

Defender for Cloud's integrated Azure Monitor Workbooks gallery includes an interactive report of findings from vulnerability scanners for machines, containers in container registries, and SQL servers.

Findings for each of these scanners are reported in separate recommendations:

The Vulnerability Assessment Findings report gathers these findings and organizes them by severity, resource type, and category. You can find this report in the workbooks gallery from Defender for Cloud's sidebar.

:::image type="content" source="media/defender-for-sql-on-machines-vulnerability-assessment/vulnerability-assessment-findings-report-sql.png" alt-text="Defender for Cloud's vulnerability assessment findings report":::

DisableExempt specific findings (recommendations)

IfNot all SQL VA findings might be relevant to your organization or configuration, and you needmight choose to ignore a finding rather than remediate it,them regardless of their status. To do this, you can optionally disable it. Disabled findings don't impactcreate an exemption at the subscription or management group level so the recommendation no longer affects your secure score or generate unwanted noise.compliance for that scope.

When a finding matches