Sensitive Data Discovery for On-Prem SQL Server

Question

Hello Microsoft Support,

Does Microsoft Defender for Cloud Sensitive Data Discovery support scanning sensitive data inside SQL Server on Machines, specifically on-premises SQL Server onboarded through Azure Arc?

We understand Defender for SQL Servers on Machines supports vulnerability assessment and threat protection, but we need confirmation whether data sensitivity discovery can scan SQL tables/columns on Arc-enabled on-prem SQL Server and show findings in Data and AI Security Dashboard / Cloud Security Explorer / Attack Paths.

Answer 1

Hello Aoutilios Maroun,At this time, Microsoft Defender for Cloud Sensitive Data Discovery does not support scanning data inside SQL Server on Machines, including on‑premises SQL Server enabled via Azure Arc.For Defender for SQL Servers on Machines, the current coverage is limited to:

• Vulnerability Assessment
• Threat Protection (alerts)

It does not perform data-level inspection of SQL tables/columns, and therefore:

• Sensitive data (PII, etc.) inside SQL databases is not discovered or classified
• No related findings will appear in Data & AI Security Dashboard, Cloud Security Explorer, or Attack Paths for Arc-enabled SQL

If your requirement is column/table-level sensitive data discovery for on-prem SQL Server, you will need to use:

• Microsoft Purview, or
• SQL Server native Data Discovery & Classification

https://learn.microsoft.com/en-us/sql/sql-server/azure-arc/configure-advanced-data-security?view=sql-server-ver17&utm_source=chatgpt.com

https://learn.microsoft.com/en-us/sql/sql-server/azure-arc/configure-advanced-data-security?view=sql-server-ver17&utm_source=chatgpt.com