Defender for SQL - Vulnerability Assessment - Status: Not Applicable

Question

Hi all,

we have a strange issue with Defender for SQL on a SQL-Server in Azure.

All findings on DBs are flagged as "Not applicable" whether with the new express mode or with the old way.

On the VAxxxx itself all the DBs from this SQL-Server are listed unter Dismissed databases.

We do not find any exemption rules or other which would create this behavior.

 With the old method we can download also the report and in fact the findings are OK - but they are exempted.

 Using a graph query we can see that there is an Exempt from the parent - but like i said - we simply cannot identify from where the exempt does come from

To add:

It worked once without problems - we then moved the entire Subscription to a new Tenant.

After that it has this strange behavior.

 

Is there a way to reforce this?

Thanks

 

 

Answer 1

Hey @Benjamin Graus

Is Microsoft Defender for Cloud enabled across your new subscription, MDC has to be specifically enabled for each subscription you want it to perform an assessment across and are you paying for MDC protection for SQL databases as there is a cost element involved

Regards

Bill

Answer 2

@Benjamin Graus

Did you find anything when looking at the exemption configs for “SQL databases should have vulnerability findings resolved”?

Note that the scan export supported in classic configuration does not take into effect exemptions or disabled rules.

Express configuration doesn’t support the export ability at the moment – but all the data should be available in ARG with the correct status, as you’ve queried in your example.

Regards

Geetha

Answer 3

@Benjamin Graus @Florian Pfeffer Thanks for being patience

Please check if you have any exemption rules.

Please follow the steps from the below document for more information and how to remove it:

Exempt a Microsoft Defender for Cloud recommendation from a resource, subscription, management group, and secure score | Microsoft Learn

Regards

Geetha