Classic configuration vulnerability findings

Microsoft Defender for Cloud provides vulnerability assessments for your Azure SQL databases. Vulnerability assessments scan your databases for software vulnerabilities and provide a list of findings. You can use the findings to remediate software vulnerabilities and disable them.

Prerequisites

Ensure you know whether you're using the express or classic configurations before continuing.

To determine your configuration:

1. In the Azure portal, open the specific resource in Azure SQL Database, SQL Managed Instance, or Azure Synapse.

2. Under the Security, select Defender for Cloud.

3. In Enablement Status, select Configure to open the Microsoft Defender for SQL settings, for the entire server, or managed instance.

If the vulnerability settings show the option to configure a storage account, you're using the classic configuration. Otherwise, you're using the express configuration.

View scan history

Select Scan History in the vulnerability assessment pane to view the history of all scans previously run on this database.

Disable specific findings from Microsoft Defender for Cloud (preview)

If you need to ignore a finding rather than remediate it, you can disable it. Disabled findings don't affect your secure score or generate noise.

When a finding matches your disable rules criteria, it doesn't appear in the findings list. Typical scenarios might include:

• Disable findings with medium or lower severity.
• Disable findings that are nonpatchable.
• Disable findings from benchmarks that aren't of interest for a defined scope.

Disable a rule

Defender for Cloud provides a way to disable specific findings.

1. Sign in to the Azure portal.

2. Navigate to Microsoft Defender for Cloud > Recommendations.

3. Search for and select Vulnerability assessment findings on your SQL servers on machines should be remediated.

4. Select Disable rule.

5. Select the scope.

6. Define your criteria. You can use the following criteria:

   • Finding ID
   • Severity
   • Benchmarks

   

7. Select Apply rule.

Changes can take up to 24 hours to take effect.

View, override, or delete a rule

1. Select Disable rule.

2. From the scope list, subscriptions with active rules show as Rule applied.

   

3. To view or delete the rule, select the ellipsis menu ("...").

Manage vulnerability assessments programmatically

Azure PowerShell

You can use Azure PowerShell cmdlets to manage your vulnerability assessments programmatically. The supported cmdlets are:

For a script example, see Azure SQL vulnerability assessment PowerShell support.

Azure CLI

You can use Azure CLI commands to manage your vulnerability assessments programmatically. The supported commands are:

Resource Manager templates

To configure vulnerability assessment baselines using Azure Resource Manager templates, use the Microsoft.Sql/servers/databases/vulnerabilityAssessments/rules/baselines type.

Ensure you have enabled vulnerabilityAssessments before you add baselines.

Here's an example for defining Baseline Rule VA2065 to master database and VA1143 to user database as resources in a Resource Manager template:

   "resources": [
      {
         "type": "Microsoft.Sql/servers/databases/vulnerabilityAapiVersion": "2018-06-01",
         "name": "[concat(parameters('server_name'),'/', parameters('database_name') , '/default/VA2065/master')]",
         "properties": {
            "baselineResults": [
               {
                  "result": [
                     "FirewallRuleName3",
                     "StartIpAddress",
                     "EndIpAddress"
                  ]
               },
               {
                  "result": [
                     "FirewallRuleName4",
                     "62.92.15.68",
                     "62.92.15.68"
                  ]
               }
            ]
         },
         "type": "Microsoft.Sql/servers/databases/vulnerabilityAapiVersion": "2018-06-01",
         "name": "[concat(parameters('server_name'),'/', parameters('database_name'), '/default/VA2130/Default')]",
         "dependsOn": [
            "[resourceId('Microsoft.Sql/servers/vulnerabilityAssessments', parameters('server_name'), 'Default')]"
         ],
         "properties": {
            "baselineResults": [
               {
                  "result": [
                     "dbo"
                  ]
               }
            ]
         }
      }
   ]

For master database and user database, the resource names are defined differently:

• Master database - "name": "[concat(parameters('server_name'),'/', parameters('database_name'), '/default/VA2065/master')]",
• User database - "name": "[concat(parameters('server_name'),'/', parameters('database_name'), '/default/VA2065/default')]",

To handle Boolean types as true/false, set the baseline result with binary input like "1"/"0".

   {
      "type": "Microsoft.Sql/servers/databases/vulnerabilityapiVersion": "2018-06-01",
      "name": "[concat(parameters('server_name'),'/', parameters('database_name'), '/default/VA1143/Default')]",

      "dependsOn": [
         "[resourceId('Microsoft.Sql/servers/vulnerabilityAssessments', parameters('server_name'), 'Default')]"
      ],

      "properties": {
         "baselineResults": [
            {
               "result": [
                  "1"
               ]
            }
         ]
      }

   }

Related content

• Learn more about Microsoft Defender for Azure SQL.
• Learn more about data discovery and classification.
• Learn more about storing vulnerability assessment scan results in a storage account accessible behind firewalls and VNets.
• Check out common questions about Azure SQL databases.