Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Disable Sql On Machines

5 November 2026Doc update+103 / −7 lines

In brief

The page now documents separate procedures for Arc-enabled servers and Azure VMs, including Arc extension block or allow lists and an Azure Policy deny assignment. It clarifies that these controls do not uninstall existing extensions or change subscription-level Defender settings.

What Defender admins need to know

Administrators excluding a resource should configure the applicable restriction before uninstalling the extension; no action is required otherwise.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • You must have Subscription Owner permissions.
  • You must have the Defender for SQL Servers on Machines plan enabled in your Defender for Cloud environment.
  • To configure an Arc-enabled server's local extension lists, you need an elevated PowerShell session on that server and the Azure Connected Machine agent.
  • For the Azure VM policy example, install Azure PowerShell, including the Az.Accounts, Az.Resources, and Az.Compute modules.

Disable Defender for SQL Servers on Machines

To disable Defender for SQL Servers on Machines at the resource level for an individual SQL Server instance or SQL virtual machine, follow these steps:

Uninstalling the extension doesn't change the subscription-level Defender plan setting. The local extension lists described here apply only to Arc-enabled servers, not Azure VMs.

  1. For an Arc-enabled server, add the extension to the local block list before uninstalling it. Alternatively, remove the extension from an existing allow list, keeping at least one other entry.

    Blocking installation doesn't remove an installed extension. Complete the uninstall steps after you configure the restriction.

  2. For an Azure VM, assign a policy that blocks the extension on that VM before uninstalling it.

  3. In the Azure portal, go to one of the following options:

    • Azure Arc > Data services > SQL Server instances
    • SQL virtual machines

  4. Select the relevant SQL Server instance.

  5. Locate the security menu and select Extensions + applications.

    Screenshot that shows where to locate Defender for Cloud under the security section.

  6. Select the Defender for SQL (IaaS and Arc) extension.

    Confirm that the extension details match the following values:

    • Extension: Defender for SQL (IaaS and Arc)
    • Publisher: Microsoft.Azure.AzureDefenderForSQL
    • Type: AdvancedThreatProtection.Windows

\ No newline at end of file 7. Select Uninstall.

Block installation locally on an Arc-enabled server

Use the Azure Connected Machine agent's local extension block list to prevent reinstallation on a specific server. Run these commands in an elevated PowerShell session on the Arc-enabled Windows server. These are azcmagent commands invoked from PowerShell, not Az PowerShell cmdlets.

  1. Add the Defender for SQL extension to the block list. The --add flag preserves existing entries.

    $AgentPath = "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe"
& $AgentPath config set extensions.blocklist `
    "Microsoft.Azure.AzureDefenderForSQL/AdvancedThreatProtection.Windows" --add
if ($LASTEXITCODE -ne 0) { throw "Couldn't add the Defender for SQL extension to the block list." }

  2. Check that the block list includes Microsoft.Azure.AzureDefenderForSQL/AdvancedThreatProtection.Windows:

    & $AgentPath config get extensions.blocklist

  3. Return to the resource-level uninstall procedure and remove the extension. The block list doesn't uninstall an existing extension.

If you manage an existing extension allow list instead, remove the Defender for SQL entry while retaining all other required entries. Don't clear the allow list or leave it empty as a way to block this extension: when neither list restricts installation, all extensions are allowed. The block list takes precedence if the extension remains in both lists.

In agent monitor mode, you can't edit the local allow list or block list.

For details, see Arc extension allow lists and block lists and azcmagent configuration commands.

Block installation on an Azure VM

Use Azure PowerShell to create a deny policy and assign it to the individual VM you want to exclude. The policy blocks only the Defender for SQL extension, identified by its publisher and type. It doesn't change restrictions on other extensions.

The policy doesn't change the subscription-level Defender plan setting or turn off automatic provisioning. Installation attempts that match the policy are denied.

  1. Sign in and select the subscription that contains the VM:

    Connect-AzAccount
Set-AzContext -SubscriptionId "<subscription-id>" -ErrorAction Stop

  2. Create a policy definition that blocks the Defender for SQL extension on Azure VMs. The definition doesn't enforce the restriction until you assign it.

    $PolicyRule = @'
{
  "if": {
    "allOf": [
      { "field": "type", "equals": "Microsoft.Compute/virtualMachines/extensions" },
      { "field": "Microsoft.Compute/virtualMachines/extensions/publisher", "equals": "Microsoft.Azure.AzureDefenderForSQL" },
      { "field": "Microsoft.Compute/virtualMachines/extensions/type", "equals": "AdvancedThreatProtection.Windows" }
    ]
  },
  "then": {
    "effect": "deny"
  }
}
'@

$Definition = New-AzPolicyDefinition `
    -Name "block-defender-sql-vm-extension" `
    -DisplayName "Block Defender for SQL extension installation on Azure VMs" `
    -Policy $PolicyRule `
    -Mode All `
    -ErrorAction Stop

  3. Get the VM and assign the policy to its resource ID. Using the VM's ID limits the assignment to that VM, rather than its resource group or subscription.

    $VM = Get-AzVM `
    -ResourceGroupName "<resource-group>" `
    -Name "<vm-name>" `
    -ErrorAction Stop

$Assignment = New-AzPolicyAssignment `
    -Name "block-defender-sql" `
    -Scope $VM.Id `
    -PolicyDefinition $Definition `
    -EnforcementMode Default `
    -ErrorAction Stop

  4. Check that the assignment targets the intended VM and that its enforcement mode is Default:

    $Assignment | Select-Object Name, Scope, EnforcementMode

    Allow time for the assignment to take effect before uninstalling the extension. A new assignment takes about five minutes to apply to its scope. For details, see Azure Policy evaluation triggers.

  5. Return to the resource-level uninstall procedure and remove the extension. Keep the assignment in place to block reinstallation. Remove the assignment before you enable protection again on that VM.

For details, see New-AzPolicyDefinition, New-AzPolicyAssignment, and restricting VM extension installation. \ No newline at end of file \ No newline at end of file