Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Update the Defender for SQL extension manually - Microsoft Defender for Cloud | Microsoft Learn

5 November 2026Doc update+169 / −0 lines

In brief

A new page explains how to update the Defender for SQL extension on Azure Arc-enabled servers and Azure VMs using the Azure portal, Azure CLI, scripts, or REST APIs. It also covers prerequisites, version verification, and the extensions in scope.

What Defender admins need to know

Administrators can use these procedures to keep the Defender for SQL extension current and verify its status without updating the SQL IaaS extension or Azure Connected Machine agent.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

layout: Conceptual title: Update the Defender for SQL extension manually - Microsoft Defender for Cloud | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/azure/defender-for-cloud/update-defender-for-sql-extension breadcrumb_path: /azure/breadcrumb/defender-for-cloud/toc.json feedback_help_link_url: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud feedback_help_link_type: ask-the-community permissioned-type: public feedback_product_url: '' uhfHeaderId: MSDocsHeader-MicrosoftDefender adobe-target: true author: ElazarK ms.author: elkrieger manager: orspodek ms.service: defender-for-cloud description: Update the Defender for SQL extension on Azure Arc-enabled servers and Azure virtual machines by using the Azure portal, scripts, or REST APIs. ms.topic: how-to ms.date: 2026-11-05T00:00:00.0000000Z ms.custom: msecd-doc-authoring-1030 ai-usage: ai-generated locale: en-us document_id: 05bb7234-973b-5b8f-e47b-993d604f3749 document_version_independent_id: e6ea93ff-1826-c16e-34ad-f95d992f92f4 original_content_git_url: https://github.com/MicrosoftDocs/defender-docs-pr/blob/live/defender-for-cloud/update-defender-for-sql-extension.md site_name: Docs depot_name: Learn.defender-for-cloud page_type: conceptual toc_rel: toc.json feedback_system: None asset_id: defender-for-cloud/update-defender-for-sql-extension moniker_range_name: monikers: [] item_type: Content source_path: defender-for-cloud/update-defender-for-sql-extension.md cmProducts:

Update the Defender for SQL extension manually - Microsoft Defender for Cloud | Microsoft Learn

Update the Defender for SQL extension on an Azure Arc-enabled server or Azure virtual machine (VM) to the latest version available in the machine's Azure region. Choose the Azure portal procedure or the scripted procedure for your machine type, then verify the installed version and SQL Server protection status.

These procedures target the extension with publisher Microsoft.Azure.AzureDefenderForSQL and type AdvancedThreatProtection.Windows. They don't update the SQL IaaS extension or the Azure Connected Machine agent.

Update by using the Azure portal

Use the portal to inspect the installed extension and update to the latest offered version where an update action is available.

Update an Arc-enabled server

  1. In the Azure portal, open Machines - Azure Arc, and select the server that hosts SQL Server.
  2. Under Settings, select Extensions.
  3. Find the Defender for SQL extension by its publisher and type.
  4. Check Update available for the latest offered version.
  5. If an update is available, select the extension, and then select Update.
  6. Refresh the extension details and verify the resulting version and status.

The Arc portal upgrade procedure documents this update action. An Arc extension upgrade preserves its configuration.

Inspect and update an Azure VM

  1. In the Azure portal, open Virtual machines, and select the VM that hosts SQL Server.
  2. Under Settings, select Extensions + applications.
  3. Select the Defender for SQL extension and review its version and status.
  4. If an extension update action is available, use it to start the update. Otherwise, use the Azure VM CLI example.
  5. Refresh the extension details and verify the resulting version and status.

The Defender for SQL troubleshooting guidance directs customers to update outdated extensions from the machine's extensions page.

Update programmatically

Use Azure CLI to update the extension on an Arc-enabled server or Azure VM.

Prerequisites

  • An Azure Arc-enabled Windows server or Azure Windows VM with the Defender for SQL extension already installed. For initial setup, see Enable Defender for SQL Servers on Machines.
  • Permission to read the machine and its extensions and perform the relevant update operation. For Arc-enabled servers, Azure Connected Machine Resource Administrator includes the extension upgrade permission. For Azure VMs, Virtual Machine Contributor includes extension management permissions. Scope permissions to the resources you manage, or use a custom role with the necessary actions. See the Arc role definition and VM role definition.
  • The network and extension deployment requirements in Defender for SQL prerequisites.
  • For the scripted procedures, PowerShell 7 and the Azure CLI.
  • For the Arc procedure, Azure CLI version 2.75.0 or later and the connectedmachine CLI extension.
  • Before either CLI procedure, sign in with az login and select the subscription with az account set --subscription "<subscription-id>".

Update an Arc-enabled server by using Azure CLI

Run these commands in PowerShell for the Arc-enabled machine that hosts SQL Server. Replace the placeholders with your resource details. The update and verification examples use the extension resource name MicrosoftDefenderForSQL. If your installed extension has a different resource name, use that name instead.

  1. Update to the latest available version. This command enables minor-version selection at deployment and leaves future automatic upgrades enabled. The output includes the extension's status.

    az connectedmachine extension update `
  --resource-group "<resource-group>" `
  --machine-name "<arc-machine-name>" `
  --name "MicrosoftDefenderForSQL" `
  --publisher "Microsoft.Azure.AzureDefenderForSQL" `
  --type "AdvancedThreatProtection.Windows" `
  --auto-upgrade-minor-version true `
  --enable-auto-upgrade true

  2. Verify the version and status if needed, or run this command later to check again. Confirm that the provisioning state is Succeeded and review the installed runtime version.

    az connectedmachine extension show `
    --resource-group "<resource-group>" `
    --machine-name "<arc-machine-name>" `
    --name "MicrosoftDefenderForSQL" `
    --output json

For command details, see Update an Arc machine extension and Show an Arc machine extension. For future automatic updates, see Automatic extension upgrade for Azure Arc-enabled servers.

Update an Azure VM by using Azure CLI

Run these commands in PowerShell to update the existing Defender for SQL extension. Replace the placeholders with your resource details.

Important

The Azure VM command requests the 2.0 handler series, not a specific four-part build. Azure delivers the latest available patch/hotfix in that series.

For the Arc proxy scenario, the required installed Defender for SQL build is 2.0.3585.403 or later. Requesting a handler series alone doesn't prove that the installed build meets this requirement.

  1. Update to the latest available version in the handler series. The command leaves future automatic upgrades enabled and returns the extension's status. --force-update requests an update even if the configuration hasn't changed.

    az vm extension set `
    --resource-group "<resource-group>" `
    --vm-name "<vm-name>" `
    --publisher "Microsoft.Azure.AzureDefenderForSQL" `
    --name "AdvancedThreatProtection.Windows" `
    --version "2.0" `
    --enable-auto-upgrade true `
    --force-update

  2. Verify the version and status if needed, or run this command later to check again. Retrieve the extension's instance view, confirm that provisioning succeeded, and review the installed runtime version and any failure details.

    az vm extension show `
    --resource-group "<resource-group>" `
    --vm-name "<vm-name>" `
    --name "AdvancedThreatProtection.Windows" `
    --instance-view `
    --output json

For command details, see Set a VM extension and Show a VM extension.

Verify the update and SQL Server protection

Check the installed runtime version, not only the requested handler version.

For Arc, inspect properties.instanceView.typeHandlerVersion in the REST representation, or the equivalent field returned by your CLI. For an Azure VM, inspect the instance view requested in the scripted procedure. Compare the reported installed build with the feature's required build. For the Arc proxy scenario, verify 2.0.3585.403 or later. A major/minor value alone doesn't establish the four-part installed build.

To confirm SQL Server protection, open the relevant SQL virtual machines or SQL Server - Azure Arc resource in the portal. Under Security, select Defender for Cloud, and confirm that Protection status is Protected. If the update fails or protection isn't healthy, use Troubleshoot Defender for SQL on machines configuration.

For the resource-level protection check, see Verify SQL machine protection. The subscription recommendation refreshes every 12 hours, so don't use an immediate recommendation change as the only verification.

REST API reference

For REST API integration, use these references.