Description:

Enable Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners'.

Rationale:

VA scan reports and alerts will be sent to admins and subscription owners by enabling setting 'Also send email notifications to admins and subscription owners'. This may help in reducing time required for identifying risks and taking corrective measures.

Impact:

Enabling the Azure Defender for SQL features will incur additional costs for each SQL server.


Default Value:

By default, 'Also send email notifications to admins and subscription owners' is enabled.

Audit:

From Azure Console

  1. Go to SQL servers.

  2. Select a server instance.

  3. Click on Security Center.

  4. Ensure that Azure Defender for SQL is set to Enabled.

  5. Select Configure next to Enabled at subscription-level.

  6. In Section Vulnerability Assessment Settings, Ensure Storage Accounts is configured.

  7. In Section Vulnerability Assessment Settings, Ensure Also send email notifications to admins and subscription owners is checked/enabled.

Using Azure PowerShell

Get the list of all SQL Servers

1Get-AZSqlServer

For each Server

1Get-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName <resource group name> -ServerName <server name>

From Azure Console

  1. Go to SQL servers.

  2. Select a server instance

  3. Click on Security Center

  4. Select Configure next to Enabled at subscription-level

  5. In Section Vulnerability Assessment Settings, configure Storage Accounts if not already.

  6. Check/enable 'Also send email notifications to admins and subscription owners'.

  7. Click Save

Using Azure PowerShell

If not already, Enable Advanced Data Security for a SQL Server:

1Set-AZSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> 2-ServerName <server name> -EmailAdmins $True 

To enable ADS-VA service and Set 'Also send email notifications to admins and subscription owners'

1Update-AzSqlServerVulnerabilityAssessmentSetting ` 2-ResourceGroupName "<resource group name>"` 3-ServerName "<Server Name>"` 4-StorageAccountName "<Storage Name from same subscription and same Location" ` 5-ScanResultsContainerName "vulnerability-assessment" ` 6-RecurringScansInterval Weekly ` 7-EmailSubscriptionAdmins $true ` 8-NotificationEmail @("[email protected]" , "[email protected]") 9 

Backout Plan:

  1. Go to SQL servers

  2. Select a server instance

  3. Click on Security Center

  4. Ensure that Azure Defender for SQL is set to Enabled

  5. In Section Vulnerability Assessment Settings, Ensure “Also send email notifications to admins and subscription owners” is disabled

References:

  1. https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability- assessment

  2. https://docs.microsoft.com/en- us/rest/api/sql/servervulnerabilityassessments/listbyserver

  3. https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Update- AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0

  4. https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Get- AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0

  5. https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-posture-vulnerability-management#pv-6-perform-software-vulnerability- assessments