Study guide
6.3 Defender for Databases
Microsoft Certified: Cloud and AI Security Engineer Associate SC-500
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 Skills Measured & Weightings 1.3 Study Path, Prerequisites & Exam Strategy
2 Microsoft Entra ID Secure Access
2.1 Privileged Identity Management (PIM) 2.2 Conditional Access Policies 2.3 MFA and Passwordless Authentication 2.4 Application Identities, OAuth Consent & Managed Identities
3 Azure Key Vault Secrets and Keys
3.1 Deploy and Configure Key Vault 3.2 Access Control and Firewall for Key Vault 3.3 Keys, Secrets, Certificates & Defender for Key Vault
4 Governance, Policy & RBAC
4.1 Azure Policy for Security Controls 4.2 Defender for Cloud Compliance & Security Standards 4.3 Resource Locks and Azure RBAC 4.4 Custom Roles, Overprivileged Access, Backup & IaC Security
5 Secure Storage Accounts
5.1 Storage Account Security Fundamentals 5.2 Storage Firewalls and Access Policies 5.3 Defender for Storage
6 Secure Databases
6.1 Azure SQL Platform Security 6.2 Database Auditing 6.3 Defender for Databases
7 Network Security Groups & Virtual Network Manager
7.1 Network Security Groups and Application Security Groups 7.2 Azure Virtual Network Manager Security Admin Rules 7.3 Virtual WAN and VPN Security
8 Private Access, Private Link & Azure Firewall
8.1 Microsoft Entra Private Access 8.2 Private Endpoints and Private Link 8.3 Azure Firewall 8.4 Network Watcher Diagnostics and Effective Rules
9 Security for AI Workloads
9.1 Purview DSPM for AI and Data Overexposure 9.2 Copilot Studio Protection and Agent Management 9.3 Microsoft Entra Agent ID Security 9.4 Defender for AI, Foundry Guardrails & AI Gateway
10 Secure Servers and Virtual Machines
10.1 Disk Encryption 10.2 Azure Bastion and JIT VM Access 10.3 Azure Arc and Defender for Servers 10.4 Trusted Launch, VM Security Features & Machine Configuration
11 Application Platform Security
11.1 Containers: AKS, ACR, ACI, Container Apps & Defender for Containers 11.2 Azure Functions and Logic Apps Security 11.3 Azure App Service Security 11.4 Web Application Firewall and API Management Protection
12 Defender for Cloud Security Posture
12.1 Defender CSPM and Secure Score 12.2 Workload Protection Plans and Multicloud Connectors 12.3 Vulnerability Management and Defender EASM
13 Microsoft Sentinel Activity and Event Collection
13.1 Workspaces, Roles & Content Hub 13.2 Data Connectors, Syslog/CEF & Windows Event Collection 13.3 Custom Tables, Retention & Purview Audit 13.4 Automation Rules and Playbooks
14 Microsoft Security Copilot & Final Review
14.1 Microsoft Security Copilot Workspaces and Roles 14.2 Plugins and Security Agents 14.3 Final Review and Exam-Day Strategy
6.3 Defender for Databases
Key Takeaways Explain This Topic AI
Defender for Databases in Microsoft Defender for Cloud packages protection plans for Azure SQL, SQL on machines, open-source relational databases, and Azure Cosmos DB—each priced and enabled as workload protection.
Microsoft Defender for SQL combines vulnerability assessment (find and remediate misconfigurations) with Advanced Threat Protection (runtime anomaly and attack alerts such as SQL injection and anomalous access).
Open-source coverage includes Azure Database for PostgreSQL and MySQL (Flexible Server) threat detection, with multicloud expansion for AWS RDS engines such as PostgreSQL, MySQL, and MariaDB where supported.
Enable plans in Defender for Cloud at subscription or resource scope; use recommendations to find unprotected servers and policy to enforce enablement.
Vulnerability findings are posture/configuration issues to remediate on a schedule; threat alerts are security incidents needing investigation—do not treat VA scores as real-time attack detection.
Last updated: July 2026
Blueprint Focus: Configure Defender for Databases
SC-500 skill language: Configure Defender for Databases protection across Azure database services. That means more than flipping one portal toggle on a single SQL DB—you should understand the Defender for Databases family, how it maps to Defender for Cloud pricing plans, and how findings differ from alerts .
What Is Defender for Databases?
In Microsoft Defender for Cloud, Defender for Databases is the umbrella that helps protect database estates with threat protection and security management across cloud environments. It includes four related offerings :
Offering Protects Core value
Microsoft Defender for Azure SQL Databases Azure SQL Database, Azure SQL Managed Instance, Azure Synapse dedicated SQL pools (as documented for the plan) VA + Advanced Threat Protection for PaaS SQL
Microsoft Defender for SQL Servers on Machines SQL Server on Azure VMs, hybrid/Arc, physical (plan-dependent) Extend SQL threat/vulnerability capabilities to IaaS/hybrid hosts
Microsoft Defender for Open-Source Relational Databases Azure Database for PostgreSQL, Azure Database for MySQL; AWS RDS engines where supported Anomalous access/query detection for OSS engines
Microsoft Defender for Azure Cosmos DB Azure Cosmos DB accounts Threat protection tailored to Cosmos access patterns
Each plan is priced separately . Enabling “Defender for Databases” in conversation usually means enabling the relevant plans for the engines you run. Free Defender for Cloud CSPM recommendations may suggest enabling paid plans; the protection features activate when the plan is on and the resource is covered.
Microsoft Defender for SQL: Two Pillars
For Azure SQL (and SQL on machines under that plan), remember the dual capability historically branded under Advanced Data Security / Defender for SQL:
1. Vulnerability Assessment (VA)
- Aspect Detail
- Purpose Discover, track, and remediate configuration and security vulnerabilities in databases
- Output Findings/recommendations with risk levels and remediation scripts/guidance
- Cadence Periodic scans (express configuration simplifies storage setup on modern portals)
Examples of themes Surface area (xp_cmdshell-like risks where applicable), principals with excessive permissions, auditing/TDE configuration gaps, authenticators, trust issues
Owner Security + DBA partnership; treat like secure score work items
VA is posture management for SQL . It does not replace a SOC analyst watching live attacks—it tells you the database is misconfigured before or alongside incidents.
2. Advanced Threat Protection (ATP)
- Aspect Detail
- Purpose Detect unusual and potentially harmful attempts to access or exploit databases
- Output Security alerts in Defender for Cloud with MITRE tactics, investigation steps, mitigation
Example detections SQL injection patterns, unusual location/principal access, brute force (including distinction of successful vs failed), potential data exfiltration/infiltration anomalies, anomalous extraction of sensitive data
Relationship to auditing Analyzes activity signals; pair with SQL auditing to Log Analytics for full statement-level forensics
Exam contrast:
VA finding: “Auditing is disabled on this server” or “Excessive permissions granted to user X” → remediate configuration .
Threat alert: “Possible SQL injection on database Y from IP Z” → investigate incident , contain identity/network, review audit batches.
Open-Source Relational Databases
Defender for Open-Source Relational Databases focuses on threat detection for engines that are not SQL Server:
Azure coverage (typical)
- Service Support notes (high level)
- Azure Database for PostgreSQL Flexible Server (all pricing tiers per Microsoft docs)
- Azure Database for MySQL Flexible Server (all pricing tiers per Microsoft docs)
- Multicloud
Where enabled, AWS RDS engines can include Aurora PostgreSQL/MySQL, PostgreSQL, MySQL, and MariaDB for threat protection and related capabilities as Microsoft rolls out GA/preview. SC-500 cares that you know protection is not SQL-only and can span open-source PaaS and multicloud RDS when connected to Defender for Cloud.
Not supported: Classic note—Defender for Open-Source Relational Databases is aimed at PaaS (Azure/AWS RDS), not arbitrary engines on Azure Arc machines under this specific plan. Hybrid SQL more often maps to SQL on machines / Arc patterns.
Alert themes for OSS plans
Anomalous database access and query patterns (for example brute-force style failed logins with many credentials)
Suspicious activity such as access from machines linked to crypto-mining C2 in threat intelligence
Alerts enriched with MITRE ATT&CK tactics and recommended next steps, with optional Microsoft Sentinel continuation
Cosmos DB and SQL on Machines (Estate Thinking)
- Plan When the exam scenario points here
- Defender for Cosmos DB App uses Cosmos; need threat alerts on anomalous data-plane access
Defender for SQL on machines SQL Server installed on Azure VM or hybrid server; need SQL-focused protection beyond generic Defender for Servers
A company with Azure SQL + PostgreSQL Flexible Server + Cosmos needs multiple database plans , not only Defender for Azure SQL. Under-scoped enablement is a common real-world gap and a fair exam stem.
- Enabling via Microsoft Defender for Cloud
- Practical enablement path
Open Microsoft Defender for Cloud → Environment settings (subscription or connector).
Enable Defender for Databases related plans (Azure SQL Databases, SQL on machines, Open-source relational databases, Cosmos DB) per need.
Confirm resources appear as protected ; remediate “Defender for SQL should be enabled on unprotected servers” style recommendations.
Optionally enforce with Azure Policy initiatives that audit/deny missing Defender for SQL on servers and Managed Instances.
Wire alert notifications (email, Logic Apps, Sentinel) so ATP alerts page humans or automation.
For VA, complete express onboarding so scans run without fragile manual storage misconfiguration.
Relationship to free recommendations
Even without paid plans, Defender for Cloud CSPM may show misconfigurations (public network access, missing Entra-only, TDE off on legacy DBs). Paid Defender for SQL adds the deep VA package and threat detection. Do not claim free CSPM alone provides full ATP for SQL.
Sensitivity discovery (adjacent)
Azure SQL data discovery and classification labels sensitive columns and feeds monitoring scenarios. It pairs with auditing and Defender insights for “who touched sensitive data” narratives. Classification is not a substitute for Always Encrypted but strengthens governance and audit context.
Vulnerability Findings vs Threat Alerts
- Dimension Vulnerability assessment findings Threat protection alerts
- Nature Security posture / misconfiguration debt Possible active attack or abuse
- Urgency Plan remediation sprints; track drift Immediate triage (P1/P2 SOC style)
Example “Server-level firewall allows large range”; “VA: permission grant anomalies” “Brute force on SQL auth”; “SQL injection”; “anomalous access from Tor-like IP”
Primary action Change config, patch permissions, enable controls Investigate, contain identity/network, forensics via audit logs
Success metric Fewer high findings over time Mean time to respond; reduced true-positive abuse
Combined operating model:
Enable Defender plans + SQL auditing to Log Analytics.
Weekly: review VA high/medium findings; assign owners.
Continuous: route ATP alerts to Sentinel/SOC with playbooks (disable login, block IP via automation carefully, open incident).
After incidents: convert lessons into Policy (Entra-only, private endpoint, Defender must be on).
Scenario: Subscription enables Defender CSPM only. PostgreSQL Flexible Server is public with weak password auth. CSPM may flag exposure, but Defender for Open-Source Relational Databases is what raises multicloud-style threat alerts on brute force and suspicious queries. Correct SC-500 answer for “detect anomalous database access on Azure Database for MySQL” is enable the open-source relational databases plan—not only NSG logging on an unrelated subnet.
Scenario: Azure SQL shows VA finding that TDE is off on a legacy database and an ATP alert for potential SQL injection the same week. Fix TDE/CMK posture and investigate the injection path in the app; one is hygiene, one is incident response.
SC-500 Exam Traps (Defender for Databases)
Defender for Databases ≠ a single product SKU; know the four offerings.
VA findings ≠ threat alerts.
Enabling Defender does not replace private endpoints, Entra-only, or TDE.
Open-source plans cover PostgreSQL/MySQL (and related multicloud RDS)—not “only SQL Server.”
SQL on machines is for VM/hybrid SQL, not a substitute for Azure SQL PaaS plan wording.
Auditing provides forensic detail; Defender provides detection—enable both for production.