# Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server

- Source: https://support.icompaas.com/support/solutions/articles/62000219840-ensure-that-va-setting-periodic-recurring-scans-is-enabled-on-a-sql-server
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [4. Database Services](https://support.icompaas.com/support/solutions/folders/62000167547)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

#### **Description:**

Enable Vulnerability Assessment (VA) Periodic recurring scans for critical SQL servers and corresponding SQL databases.

#### **Rationale:**

VA setting 'Periodic recurring scans' schedules periodic (weekly) vulnerability scanning for the SQL server and corresponding Databases. Periodic and regular vulnerability scanning provides risk visibility based on updated known vulnerability signatures and best practices.

#### **Impact:**

Enabling the Azure Defender for SQL feature will incur additional costs for each SQL server.

  

#### **Default Value:**

Enabling Azure Defender for SQL enables 'Periodic recurring scans' by default but does not configure the Storage account.

#### **Audit:**

**From Azure Console**

1.  Go to SQL servers![](https://support.icompaas.com/assets/kb/136e11947b157f34.png)
    
2.  Select a server instance
    
3.  Click on Security Center
    
4.  Ensure that Azure Defender for SQL is set to Enabled![](https://support.icompaas.com/assets/kb/9a049cefcc56c409.png)
    
5.  In Section Vulnerability Assessment Settings, Ensure Storage Accounts is configured.
    
6.  In Section Vulnerability Assessment Settings, Ensure Periodic recurring scans is set to On![](https://support.icompaas.com/assets/kb/3aad1e86f783c9f2.png)
    

**Using Azure PowerShell**

Get the list of all SQL Servers

`1Get-AZSqlServer`

For each Server

`1Get-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName <resource group name> -ServerName <server name>`

#### **Remediation:**

**From Azure Console**

1.  Go to SQL servers
    
2.  For each server instance
    
3.  Click on Security Center![](https://support.icompaas.com/assets/kb/36acb2e8c6e913e6.png)
    
4.  In Section Vulnerability Assessment Settings, set Storage Account if not already
    
5.  Toggle 'Periodic recurring scans' to ON![](https://support.icompaas.com/assets/kb/da8e272ba0902df8.png)
    
6.  Click Save
    

#### **Using Azure PowerShell**

If not already, Enable Advanced Data Security for a SQL Server:

`1Set-AZSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> 2-ServerName <server name> -EmailAdmins $True` 

To enable ADS-VA service with 'Periodic recurring scans'

``1Update-AzSqlServerVulnerabilityAssessmentSetting ` 2-ResourceGroupName "<resource group name>"` 3-ServerName "<Server Name>"` 4-StorageAccountName "<Storage Name from same subscription and same Location" ` 5-ScanResultsContainerName "vulnerability-assessment" ` 6-RecurringScansInterval Weekly ` 7-EmailSubscriptionAdmins $true ` 8-NotificationEmail @("mail1@mail.com" , "mail2@mail.com")`` 

#### **Backout Plan:**

1.  Go to SQL servers
    
2.  Select a server instance
    
3.  Click on Security Center
    
4.  Ensure that Azure Defender for SQL is set to Enabled
    
5.  In Section Vulnerability Assessment Settings, Ensure Storage Accounts is not configured
    

#### **References:**

1.  [https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability- assessment](https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability-assessment "https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability-assessment")
    
2.  [https://docs.microsoft.com/en- us/rest/api/sql/servervulnerabilityassessments/listbyserver](https://docs.microsoft.com/en-us/rest/api/sql/servervulnerabilityassessments/listbyserver "https://docs.microsoft.com/en-us/rest/api/sql/servervulnerabilityassessments/listbyserver")
    
3.  [https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Update- AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0](https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Update-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0 "https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Update-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0")
    
4.  [https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Get- AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0](https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Get-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0 "https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Get-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0")
    
5.  [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-posture-vulnerability-management#pv-6-perform-software-vulnerability- assessments](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-posture-vulnerability-management#pv-6-perform-software-vulnerability-assessments "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-posture-vulnerability-management#pv-6-perform-software-vulnerability-assessments")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.