6.3 Defender for Databases
Key Takeaways
- Defender for Databases in Microsoft Defender for Cloud packages protection plans for Azure SQL, SQL on machines, open-source relational databases, and Azure Cosmos DB—each priced and enabled as workload protection.
- Microsoft Defender for SQL combines vulnerability assessment (find and remediate misconfigurations) with Advanced Threat Protection (runtime anomaly and attack alerts such as SQL injection and anomalous access).
- Open-source coverage includes Azure Database for PostgreSQL and MySQL (Flexible Server) threat detection, with multicloud expansion for AWS RDS engines such as PostgreSQL, MySQL, and MariaDB where supported.
- Enable plans in Defender for Cloud at subscription or resource scope; use recommendations to find unprotected servers and policy to enforce enablement.
- Vulnerability findings are posture/configuration issues to remediate on a schedule; threat alerts are security incidents needing investigation—do not treat VA scores as real-time attack detection.
Blueprint Focus: Configure Defender for Databases
SC-500 skill language: Configure Defender for Databases protection across Azure database services. That means more than flipping one portal toggle on a single SQL DB—you should understand the Defender for Databases family, how it maps to Defender for Cloud pricing plans, and how findings differ from alerts.
What Is Defender for Databases?
In Microsoft Defender for Cloud, Defender for Databases is the umbrella that helps protect database estates with threat protection and security management across cloud environments. It includes four related offerings:
| Offering | Protects | Core value |
|---|---|---|
| Microsoft Defender for Azure SQL Databases | Azure SQL Database, Azure SQL Managed Instance, Azure Synapse dedicated SQL pools (as documented for the plan) | VA + Advanced Threat Protection for PaaS SQL |
| Microsoft Defender for SQL Servers on Machines | SQL Server on Azure VMs, hybrid/Arc, physical (plan-dependent) | Extend SQL threat/vulnerability capabilities to IaaS/hybrid hosts |
| Microsoft Defender for Open-Source Relational Databases | Azure Database for PostgreSQL, Azure Database for MySQL; AWS RDS engines where supported | Anomalous access/query detection for OSS engines |
| Microsoft Defender for Azure Cosmos DB | Azure Cosmos DB accounts | Threat protection tailored to Cosmos access patterns |
Each plan is priced separately. Enabling “Defender for Databases” in conversation usually means enabling the relevant plans for the engines you run. Free Defender for Cloud CSPM recommendations may suggest enabling paid plans; the protection features activate when the plan is on and the resource is covered.
Microsoft Defender for SQL: Two Pillars
For Azure SQL (and SQL on machines under that plan), remember the dual capability historically branded under Advanced Data Security / Defender for SQL:
1. Vulnerability Assessment (VA)
| Aspect | Detail |
|---|---|
| Purpose | Discover, track, and remediate configuration and security vulnerabilities in databases |
| Output | Findings/recommendations with risk levels and remediation scripts/guidance |
| Cadence | Periodic scans (express configuration simplifies storage setup on modern portals) |
| Examples of themes | Surface area (xp_cmdshell-like risks where applicable), principals with excessive permissions, auditing/TDE configuration gaps, authenticators, trust issues |
| Owner | Security + DBA partnership; treat like secure score work items |
VA is posture management for SQL. It does not replace a SOC analyst watching live attacks—it tells you the database is misconfigured before or alongside incidents.
2. Advanced Threat Protection (ATP)
| Aspect | Detail |
|---|---|
| Purpose | Detect unusual and potentially harmful attempts to access or exploit databases |
| Output | Security alerts in Defender for Cloud with MITRE tactics, investigation steps, mitigation |
| Example detections | SQL injection patterns, unusual location/principal access, brute force (including distinction of successful vs failed), potential data exfiltration/infiltration anomalies, anomalous extraction of sensitive data |
| Relationship to auditing | Analyzes activity signals; pair with SQL auditing to Log Analytics for full statement-level forensics |
Exam contrast:
- VA finding: “Auditing is disabled on this server” or “Excessive permissions granted to user X” → remediate configuration.
- Threat alert: “Possible SQL injection on database Y from IP Z” → investigate incident, contain identity/network, review audit batches.
Open-Source Relational Databases
Defender for Open-Source Relational Databases focuses on threat detection for engines that are not SQL Server:
Azure coverage (typical)
| Service | Support notes (high level) |
|---|---|
| Azure Database for PostgreSQL | Flexible Server (all pricing tiers per Microsoft docs) |
| Azure Database for MySQL | Flexible Server (all pricing tiers per Microsoft docs) |
Multicloud
Where enabled, AWS RDS engines can include Aurora PostgreSQL/MySQL, PostgreSQL, MySQL, and MariaDB for threat protection and related capabilities as Microsoft rolls out GA/preview. SC-500 cares that you know protection is not SQL-only and can span open-source PaaS and multicloud RDS when connected to Defender for Cloud.
Not supported: Classic note—Defender for Open-Source Relational Databases is aimed at PaaS (Azure/AWS RDS), not arbitrary engines on Azure Arc machines under this specific plan. Hybrid SQL more often maps to SQL on machines / Arc patterns.
Alert themes for OSS plans
- Anomalous database access and query patterns (for example brute-force style failed logins with many credentials)
- Suspicious activity such as access from machines linked to crypto-mining C2 in threat intelligence
- Alerts enriched with MITRE ATT&CK tactics and recommended next steps, with optional Microsoft Sentinel continuation
Cosmos DB and SQL on Machines (Estate Thinking)
| Plan | When the exam scenario points here |
|---|---|
| Defender for Cosmos DB | App uses Cosmos; need threat alerts on anomalous data-plane access |
| Defender for SQL on machines | SQL Server installed on Azure VM or hybrid server; need SQL-focused protection beyond generic Defender for Servers |
A company with Azure SQL + PostgreSQL Flexible Server + Cosmos needs multiple database plans, not only Defender for Azure SQL. Under-scoped enablement is a common real-world gap and a fair exam stem.
Enabling via Microsoft Defender for Cloud
Practical enablement path
- Open Microsoft Defender for Cloud → Environment settings (subscription or connector).
- Enable Defender for Databases related plans (Azure SQL Databases, SQL on machines, Open-source relational databases, Cosmos DB) per need.
- Confirm resources appear as protected; remediate “Defender for SQL should be enabled on unprotected servers” style recommendations.
- Optionally enforce with Azure Policy initiatives that audit/deny missing Defender for SQL on servers and Managed Instances.
- Wire alert notifications (email, Logic Apps, Sentinel) so ATP alerts page humans or automation.
- For VA, complete express onboarding so scans run without fragile manual storage misconfiguration.
Relationship to free recommendations
Even without paid plans, Defender for Cloud CSPM may show misconfigurations (public network access, missing Entra-only, TDE off on legacy DBs). Paid Defender for SQL adds the deep VA package and threat detection. Do not claim free CSPM alone provides full ATP for SQL.
Sensitivity discovery (adjacent)
Azure SQL data discovery and classification labels sensitive columns and feeds monitoring scenarios. It pairs with auditing and Defender insights for “who touched sensitive data” narratives. Classification is not a substitute for Always Encrypted but strengthens governance and audit context.
Vulnerability Findings vs Threat Alerts
| Dimension | Vulnerability assessment findings | Threat protection alerts |
|---|---|---|
| Nature | Security posture / misconfiguration debt | Possible active attack or abuse |
| Urgency | Plan remediation sprints; track drift | Immediate triage (P1/P2 SOC style) |
| Example | “Server-level firewall allows large range”; “VA: permission grant anomalies” | “Brute force on SQL auth”; “SQL injection”; “anomalous access from Tor-like IP” |
| Primary action | Change config, patch permissions, enable controls | Investigate, contain identity/network, forensics via audit logs |
| Success metric | Fewer high findings over time | Mean time to respond; reduced true-positive abuse |
Combined operating model:
- Enable Defender plans + SQL auditing to Log Analytics.
- Weekly: review VA high/medium findings; assign owners.
- Continuous: route ATP alerts to Sentinel/SOC with playbooks (disable login, block IP via automation carefully, open incident).
- After incidents: convert lessons into Policy (Entra-only, private endpoint, Defender must be on).
Scenario: Subscription enables Defender CSPM only. PostgreSQL Flexible Server is public with weak password auth. CSPM may flag exposure, but Defender for Open-Source Relational Databases is what raises multicloud-style threat alerts on brute force and suspicious queries. Correct SC-500 answer for “detect anomalous database access on Azure Database for MySQL” is enable the open-source relational databases plan—not only NSG logging on an unrelated subnet.
Scenario: Azure SQL shows VA finding that TDE is off on a legacy database and an ATP alert for potential SQL injection the same week. Fix TDE/CMK posture and investigate the injection path in the app; one is hygiene, one is incident response.
SC-500 Exam Traps (Defender for Databases)
- Defender for Databases ≠ a single product SKU; know the four offerings.
- VA findings ≠ threat alerts.
- Enabling Defender does not replace private endpoints, Entra-only, or TDE.
- Open-source plans cover PostgreSQL/MySQL (and related multicloud RDS)—not “only SQL Server.”
- SQL on machines is for VM/hybrid SQL, not a substitute for Azure SQL PaaS plan wording.
- Auditing provides forensic detail; Defender provides detection—enable both for production.
Which pair of capabilities is provided by Microsoft Defender for SQL on Azure SQL Database?
Your estate includes Azure SQL Managed Instance, Azure Database for PostgreSQL Flexible Server, and Azure Cosmos DB. Leadership asks you to “turn on Defender for Databases.” What is the correct interpretation?
Defender for Cloud reports a vulnerability assessment finding that a SQL login has excessive privileges, and separately raises a high-severity alert for possible SQL injection. How should a security engineer treat these items?
Which Azure open-source database scenario is best addressed by Microsoft Defender for Open-Source Relational Databases?