Find and fix vulnerabilities in your Azure SQL databases

Microsoft Defender for Cloud provides SQL vulnerability assessment for your Azure SQL databases. SQL vulnerability assessment scans your databases for software vulnerabilities and provides a list of findings. Use the findings to fix software vulnerabilities and disable findings.

SQL vulnerability assessment is available in two configurations: express (managed storage in the logical server region) and classic (user-owned storage account in a chosen region).

Prerequisites

Make sure that you know whether you're using the express or classic configurations before you continue.

To see which configuration you're using:

1. In the Azure portal, open the specific resource in Azure SQL Database, SQL Managed Instance Database, or Azure Synapse.

2. Under the Security heading, select Defender for Cloud.

3. In the Enablement Status, select Configure to open the Microsoft Defender for SQL settings pane for either the entire server or managed instance.

If the vulnerability settings show the option to configure a storage account, you're using the classic configuration. If not, you're using the express configuration.

Understanding express and classic configurations

Both configurations provide the same vulnerability scanning capabilities but differ in how and where scan results are stored. This affects permissions, data residency, and how quickly baseline changes are reflected.

Configuration comparison summary

The table compares the key differences between the configurations:

Run scans and manage baselines

The scan makes no changes to your database, is read-only, and appears in the Vulnerability Assessment tab.

Both configurations use the same scan workflow. The key difference is when they apply the baselines. Express configuration applies it immediately, and classic configuration applies it after you run a new scan.

Perform an on-demand scan

1. From the resource's Defender for Cloud page, select View additional findings in Vulnerability Assessment to access previous scan results.

   

2. Select Scan from the toolbar to run an on-demand SQL vulnerability assessment.

   

3. (Optional) Mark acceptable findings as baseline.

4. View baseline-approved findings in subsequent results (timing differs by configuration).

Manage baselines

Once you run a scan, mark acceptable findings as baseline to customize future results. Configurations with baseline approval pass in later scans.

Baseline outcome quick reference

Review and remediate vulnerabilities

After a scan completes, the vulnerability assessment report shows a full view of your database security. Both the express and classic configurations use the same remediation workflow and baseline management.

Understand scan results

The vulnerability assessment report includes:

• An overview of your security state
• The number of issues found
• A severity summary of risks
• A list of findings for investigation

Remediation and baseline procedure

1. Review scan results to identify security issues relevant to your environment.

2. Select each failed result to view detailed information, including impact and failure reasons.

   Tip

   Each finding's details page includes actionable remediation guidance to help you address the vulnerability.

   

   

3. Mark acceptable findings as baseline to prevent them from appearing as failures in future scans.

   

4. View Passed status for baseline-approved findings:

   • Express: Appears immediately without a new scan.
   • Classic: Requires running another on-demand scan.

Outcome: SQL vulnerability assessment scan cycles help maintain a high security level and ensure compliance with organizational security policies.

Troubleshoot common issues

Use this table to resolve common issues when working with SQL vulnerability assessment:

Next steps

• Learn more about Microsoft Defender for Azure SQL.
• Learn more about data discovery and classification.
• Learn more about storing vulnerability assessment scan results in a storage account accessible behind firewalls and VNets.