SQL Vulnerability Assessment (SQL VA) is a core capability in Defender for SQL that helps customers identify possible misconfigurations, excessive permissions, and other deviations from security best practices through continuous scanning of their databases. Traditionally, enabling SQL VA on SQL PaaS resources required customers to provision and maintain a dedicated Azure Storage account to hold scan results and baselines. In addition, managing SQL VA across resource types required different API endpoints, which made it harder to script consistent enablement and baseline management across a mixed SQL estate. For customers managing large SQL estates, this added operational overhead to onboarding and ongoing management. This friction may lead to inconsistent enablement across environments and leave gaps in vulnerability visibility.
To simplify this experience, Microsoft introduced Express Configuration, which uses Microsoft-managed storage and does not require a customer-provisioned storage account. Express Configuration is generally available for Azure SQL Database and is the recommended enablement mode for SQL VA, where supported.
This public preview extends Express Configuration to Azure SQL Managed Instance and Azure Synapse Analytics workspaces, and introduces a new preview API version that brings SQL VA management under a unified model across Azure SQL Database, SQL Managed Instance, Synapse workspaces, and SQL on machines (Azure VMs and Arc-enabled SQL Servers). Customers can now enable SQL VA on SQL Managed Instance and Synapse workspaces without provisioning a dedicated storage account and can manage SQL VA across all supported resource types through a single API.
Together, these changes broaden Express Configuration coverage across Azure SQL PaaS services and consolidate SQL VA operations under a single API, helping standardize how SQL VA is enabled and managed and reduce operational overhead across a customer's SQL estate.
What’s new in this release
- Express Configuration support for additional Azure SQL PaaS services: Azure SQL Managed Instance (public preview) and Azure Synapse Analytics workspaces (dedicated SQL pools, public preview); Express Configuration for Azure SQL Database remains generally available.
- Express Configuration is the default when enabling Defender for SQL on a resource from the UI.
- New preview API version for unified SQL VA management across Azure SQL Database, SQL Managed Instance, Azure Synapse Analytics workspaces (Express Configuration only), and SQL on machines (Azure Virtual Machines and Arc-enabled SQL Servers).
Why use Express Configuration
Express Configuration simplifies how SQL Vulnerability Assessment is enabled and managed for Azure SQL Managed Instance and Azure Synapse Analytics workspaces, without changing the security coverage or rule set provided by SQL VA.
- No customer-managed storage required. Express Configuration uses Microsoft-managed storage, so customers don’t need to provision or maintain storage accounts for scan results and baselines.
- Automatic weekly scans and on-demand scans through the UI, unified API, or scripts.
- Baseline management at scale, including setting baselines per finding or in bulk. Baseline changes take effect without waiting for the next scan to complete.
Unified management across SQL platforms
The latest preview API version enables a unified model for configuration, scanning, and governance for SQL Vulnerability Assessment across all supported SQL deployments:
- Manage SQL VA across Azure SQL Database, SQL Managed Instance, and Azure Synapse Analytics workspaces.
- Manage SQL VA across SQL on machines, including Azure Virtual Machines and Arc-enabled SQL Servers.
- Use a consistent model for configuration, scans, results retrieval, and baseline management across supported resource types.
Limitations and prerequisites Permissions
|
Task |
Required roles |
|
View SQL vulnerability assessment results in Microsoft Defender for Cloud recommendations |
Security Admin or Security Reader |
|
Change SQL vulnerability assessment settings |
Security Admin or SQL Security Manager |
|
Access resource-level scan results or automated email links |
Security Admin or SQL Security Manager |
- Classic Configuration conflict: If Classic Configuration is already enabled on a resource, enabling Express Configuration through the API will fail with an error. To migrate an existing Classic Configuration to Express Configuration, use the updated migration script.
- UI enablement supports clearing Classic Configuration settings and re-enabling with Express Configuration.
- SQL Managed Instance prerequisite: A system-assigned managed identity is required for Express Configuration to work on SQL Managed Instance.
- Preview enablement scope: During public preview subscription-level enablement does not automatically apply Express Configuration to SQL Managed Instance or Synapse workspaces during public preview.
- Reverting to Classic Configuration: After migrating to Express Configuration, reverting to Classic Configuration is possible programmatically but not through the UI.
Get started
- Try it through the portal: Enable Express Configuration on a SQL Managed Instance or Synapse workspace through the Defender for Cloud portal, run an on-demand scan, and review findings in Defender for Cloud recommendations.
- Automate your first steps: Use the SQL VA Express Configuration quickstart script to enable Express Configuration, discover databases, run scans, and manage baselines through the unified API.
- Migrate from Classic Configuration: If you have Classic Configuration enabled on existing resources, use the migration script to move to Express Configuration.
Microsoft