Azure Question posted in
The official documentation to get you started can be found here.

Powershell or AzureCLI command to enable Microsoft Defender for SQL

Because I am not allowed to enable Microsoft Defender for SQL from Azure Portal, I am tring to find a Powershell or AzureCLI command to enable it from CloudShell. The final step is to use that command in a pipeline. I am expecting to be a command that get as parameters the name of the server and the group and automatically enable the Microsoft Defender for SQL.

I tried this:

az sql server threat-policy update --resource-group <my-resource-group> --server-name <my-sql-server-name> --state Enabled

The answer was:

‘threat-policy’ is misspelled or not recognized by the system.

EDIT
After more investigation I have found a partial solution. I will explain bellow:

  1. In the first state the status is disabled: "Enabled status: Disabled"
  2. After I run the following command:
Update-AzSqlServerAdvancedThreatProtectionSetting -Enable $true -ResourceGroupName 'my-resource-group' -ServerName 'my-server-name'

the status was changed to "Enabled status: Enabled at the subscription-level"
and bellow of the status an warning is shown with an "enable" button saying that "SQL Vulnerability Assessment is not configured. Click to enable express configuration".

  1. I would like to have also the "Vulnerability Assesment" enabled in order to have an overview of the findings. I thought this is part of Microsoft Defender for SQL, and enabled it will enable also the "Voulnerability assesment". Are these different?
Tags:

2

Answers


  1. 0

    I haven’t checked the commands, but their description here in the docs makes me believe that they create and enable Microsoft Defender For SQL. This enables the pricing plan for the entire subscription rather than for an individual resource, as it seems that doing that programmatically might require a POST request to the ARM API.

    Login or Signup to reply.
  2. 0

    I have one SQL server named samplesql28 where Microsoft Defender is currently not enabled as below:

    enter image description here

    Initially, I too got same error when I ran your command in my environment like this:

    az sql server threat-policy update --resource-group rgname --server-name servername --state Enabled

    enter image description here

    The error occurred as the CLI command you are using is currently deprecated and no longer supported. Check this MS Doc.

    To enable Microsoft Defender for SQL under subscription level, make use of below CLI command:

    az security pricing create -n SqlServers --tier standard

    Response:

    enter image description here

    When I checked the same in Portal, Microsoft Defender for SQL enabled successfully as below:

    enter image description here

    Reference:

    Microsoft Defender for SQL – Azure SQL Database

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search