Overview of Microsoft Defender for Azure SQL
Microsoft Defender for Azure SQL helps you discover and mitigate potential database vulnerabilities and alerts you to anomalous activities that might be an indication of a threat to your databases.
- Vulnerability assessment: Scan databases to discover, track, and remediate vulnerabilities. Learn more about vulnerability assessment.
- Threat protection: Receive detailed security alerts and recommended actions based on SQL Advanced Threat Protection to mitigate threats. Learn more about SQL Advanced Threat Protection.
When you enable Microsoft Defender for Azure SQL, all supported resources that exist within the subscription are protected. Future resources created on the same subscription will also be protected.
Availability
| Aspect | Details |
|---|---|
| Release state: | Generally available (GA) |
| Pricing: | Microsoft Defender for Azure SQL is billed as shown on the pricing page |
| Protected SQL versions: | Read-write replicas of: - Azure SQL single databases and elastic pools - Azure SQL Managed Instance - Azure Synapse Analytics (formerly SQL DW) dedicated SQL pool |
| Clouds: | 
Commercial clouds
Azure Government
Microsoft Azure operated by 21Vianet (Partial: Subset of alerts and vulnerability assessment for SQL servers. Behavioral threat protections aren't available.) |
What are the benefits of Microsoft Defender for Azure SQL?
Discover and mitigate vulnerabilities
A vulnerability assessment service discovers, tracks, and helps you remediate potential database vulnerabilities. Assessment scans provide an overview of your SQL machines' security state, and details of any security findings. Defender for Azure SQL helps you identify and mitigate potential database vulnerabilities and detecting anomalous activities that could indicate threats to your databases.
Learn more about vulnerability assessment for Azure SQL Database.
Advanced threat protection
An advanced threat protection service continuously monitors your SQL servers for threats such as SQL injection, brute-force attacks, and privilege abuse. This service provides action-oriented security alerts in Microsoft Defender for Cloud with details of the suspicious activity, guidance on how to mitigate to the threats, and options for continuing your investigations with Microsoft Sentinel. Learn more about advanced threat protection.
Threat intelligence enriched security alerts are triggered when there's:
- Potential SQL injection attacks - including vulnerabilities detected when applications generate a faulty SQL statement in the database
- Anomalous database access and query patterns - for example, an abnormally high number of failed sign-in attempts with different credentials (a brute force attempt)
- Suspicious database activity - for example, a legitimate user accessing an SQL Server from a breached computer that communicated with a crypto-mining C&C server
Alerts include details of the incident that triggered them, and recommendations on how to investigate and remediate threats. Learn more about the security alerts for SQL servers.
Next steps
In this article, you learned about Microsoft Defender for Azure SQL. Now you can:
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for