# Ensure that VA setting Send scan reports to is configured for a SQL server

- Source: https://support.icompaas.com/support/solutions/articles/62000219863-ensure-that-va-setting-send-scan-reports-to-is-configured-for-a-sql-server
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [4. Database Services](https://support.icompaas.com/support/solutions/folders/62000167547)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

#### **Description:**

Configure 'Send scan reports to' with email ids of concerned data owners/stakeholders for a critical SQL servers.

#### **Rationale:**

Vulnerability Assessment (VA) scan reports and alerts will be sent to email ids configured at 'Send scan reports to'. This may help in reducing time required for identifying risks and taking corrective measures.

#### **Impact:**

Enabling the Azure Defender for SQL features will incur additional costs for each SQL server.

  

#### **Default Value:**

By default, 'Send reports to' is blank.

#### **Audit:**

**From Azure Console**

1.  Go to SQL servers.![](https://support.icompaas.com/assets/kb/1d6b28dd439df622.png)
    
2.  Select a server instance.
    
3.  Click on Security Center.
    
4.  Ensure that Azure Defender for SQL is set to Enabled.![](https://support.icompaas.com/assets/kb/f6b9cea7532ec398.png)
    
5.  Select Configure next to Enabled at subscription-level.![](https://support.icompaas.com/assets/kb/631478678e391a23.png)
    
6.  In Section Vulnerability Assessment Settings, Ensure Storage Accounts is Configured.![](https://support.icompaas.com/assets/kb/69af21c27a28cc6b.png)
    
7.  In Section Vulnerability Assessment Settings, Ensure Send scan reports to is not empty.
    

#### **Using Azure PowerShell**

Get the list of all SQL Servers

`1Get-AZSqlServer`

For each Server

`1Get-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName <resource group name> -ServerName <server name>`

#### **Remediation:**

**From Azure Console**

1.  Go to SQL servers.![](https://support.icompaas.com/assets/kb/1a73bac629f48f55.png)
    
2.  Select a server instance.
    
3.  Click on Security Center.
    
4.  Ensure that Azure Defender for SQL is set to Enabled.![](https://support.icompaas.com/assets/kb/fd7de160e547148d.png)
    
5.  Select Configure next to Enabled at subscription-level.![](https://support.icompaas.com/assets/kb/a4105e64fb95bc54.png)
    
6.  In Section Vulnerability Assessment Settings, configure Storage Accounts if not already.![](https://support.icompaas.com/assets/kb/d00c877958bdde7b.png)
    
7.  Configure email ids for concerned data owners/stakeholders at 'Send scan reports to'.
    
8.  Click Save.
    

#### **Using Azure PowerShell**

If not already, Enable Advanced Data Security for a SQL Server:

`1Set-AZSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> 2-ServerName <server name> -EmailAdmins $True` 

To enable ADS-VA service and Set 'Send scan reports to'

``1Update-AzSqlServerVulnerabilityAssessmentSetting ` 2-ResourceGroupName "<resource group name>"` 3-ServerName "<Server Name>"` 4-StorageAccountName "<Storage Name from same subscription and same Location" ` 5-ScanResultsContainerName "vulnerability-assessment" ` 6-RecurringScansInterval Weekly ` 7-EmailSubscriptionAdmins $true ` 8-NotificationEmail @("mail1@mail.com" , "mail2@mail.com")`` 

#### **Backout Plan:**

1.  Go to SQL servers
    
2.  Select a server instance
    
3.  Click on Security Center
    
4.  Ensure that Azure Defender for SQL is set to Enabled
    
5.  In Section Vulnerability Assessment Settings, Ensure “Send scan reports to” is blank
    

#### **References:**

1.  [https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability- assessment](https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability-assessment "https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability-assessment")
    
2.  [https://docs.microsoft.com/en- us/rest/api/sql/servervulnerabilityassessments/listbyserver](https://docs.microsoft.com/en-us/rest/api/sql/servervulnerabilityassessments/listbyserver "https://docs.microsoft.com/en-us/rest/api/sql/servervulnerabilityassessments/listbyserver")
    
3.  [https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Update- AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0](https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Update-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0 "https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Update-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0")
    
4.  [https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Get- AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0](https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Get-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0 "https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Get-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0")
    
5.  [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-posture-vulnerability-management#pv-6-perform-software-vulnerability- assessments](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-posture-vulnerability-management#pv-6-perform-software-vulnerability-assessments "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-posture-vulnerability-management#pv-6-perform-software-vulnerability-assessments")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.