Vulnerability Assessment and Advanced Threat Protection not being automatically enabled.

Question

I have been trying to get Vulnerability Assessment (VA) and Advanced Threat Protection (ATP) enabled on my Azure SQL databases without much luck. The behaviour I am seeing contradicts the documentation.

Following Microsoft's recommended approach I enabled Defender for SQL at the subscription level.

According to the documentation, with this setup, protection of resources should be automatic.

We recommend enabling Microsoft Defender plans at the subscription level so that new resources are automatically protected.

Source

When you enable the Defender for Azure SQL plan in Defender for Cloud, Defender for Cloud automatically enables Advanced Threat Protection and vulnerability assessment with the express configuration for all Azure SQL databases in the selected subscription.

Source

However in reality, it seems that both VA and ATP need to be enabled manually.

Initially after deployment both the SQL Server and SQL Database resources show Defender for SQL as being "Not configure" on the Overview blade and "Disabled" on the Microsoft Defender for Cloud blade.

After waiting about 7 or 8 minutes this changes.

Both the SQL Server and DB resources show that it is Partially Configured (Overview blade) and "Enabled at the subscription-level" on the Defender blade.

Also, the yellow box has appeared informing me that VA is not configured and I'm invited to Enable this. My understanding of the documentation was that this step should not be required and VA should be automatically enabled.

I click the Enable button.

I'm now able to run VA scans from the Defender blade and view the results.

There is nothing in the Azure portal that I can see for configuring ATP. I used the CLI to check the status, and it is showing as disabled.

I use the Azure CLI to enable ATP on my database.

At this point the SQL Server resource shows Defender as being Configured (Overview blade)

and "Enabled at the subscription-level" on the Defender blade.

Below is what that configuration page looks like:

Questions:

1. After all the above, the DB is still showing Defender as being "Partially Configured" on the Overview blade. What else needs configuring to make this show as Configured?
2. The documentation clearly states that when you enable Defender at the subscription-level, VA and ATP are enabled on all DBs in the selected subscription. Why are they not being enabled automatically?