At a glance
| Supported databases | Azure SQL Database, SQL Managed Instance, Synapse dedicated SQL pools, SQL Server 2012 to 2022 on Azure VMs or Azure Arc |
| Auditing and activity monitoring | Threat detection on activity; not a full audit trail (use SQL auditing for that) |
| Masking | Not part of Defender for SQL (Azure SQL has separate dynamic data masking) |
| Encryption or tokenization | Not part of Defender for SQL |
| Privileged access | Vulnerability assessment flags permission issues; no privileged access management |
| Policy enforcement | Azure Policy and recommendations; alerts do not block queries |
| Compliance reporting | Findings and recommendations in Defender for Cloud |
| Deployment | Managed Azure service; Defender for SQL extension on VMs and Arc machines |
| Licensing | Azure consumption billing; 30-day free trial; DWU model in preview |
For SQL Server and Azure SQL estates already on Azure, Defender for SQL is the lowest-effort way to add vulnerability scanning and threat alerts, enabled per subscription and billed through Azure. It is not a full audit trail or masking tool: keep SQL Server Audit or Azure SQL auditing for evidence, and watch the move to DWU-based billing.
Overview
Microsoft Defender for SQL is not a separate product but a set of plans in Microsoft Defender for Cloud. Defender for Azure SQL Databases protects Azure SQL single databases and elastic pools, SQL Managed Instance and Synapse dedicated SQL pools. Defender for SQL Servers on Machines protects SQL Server on Azure VMs and SQL Server instances enabled by Azure Arc, which is how on-premises, AWS and Google Cloud machines are covered. Both sit under the Defender for Databases plan and protect every supported resource in a subscription once enabled, including new ones.
Each plan combines vulnerability assessment (scans of configuration and permissions with baselines and remediation steps) and Advanced Threat Protection, which alerts on potential SQL injection, anomalous access and query patterns, brute-force sign-in attempts and suspicious activity, with links to Microsoft Sentinel for investigation. On machines, the Defender for SQL extension collects data through Extended Events from SQL Server 2017 onward and SQL Server audit logs on earlier versions, on Windows Server 2012 R2 or later.
Key features
- Vulnerability assessment with express configuration, recurring scans and baselines
- Advanced Threat Protection alerts for SQL injection, brute force and anomalous access
- Subscription-wide enablement that also covers newly created resources
- Coverage of SQL Server outside Azure through Azure Arc, including AWS and Google Cloud
- Security alerts with mitigation guidance and Microsoft Sentinel investigation
- Workflow automation through Logic Apps for scan and alert notifications
Integrations and ecosystem
Pros and cons
Pros
- Enabled per subscription with no appliances to run
- Covers Azure SQL and SQL Server on Azure, on premises and other clouds through Arc
- Combines vulnerability assessment and threat alerts in one plan
- Public meter prices available through Microsoft's pricing API
Cons
- Microsoft SQL only within these plans; other engines need separate Defender plans
- Machines outside Azure must be onboarded to Azure Arc, and the extension requires sysadmin rights for the SQL service account
- Alerts do not block queries and do not replace audit logging
- Billing is changing to Defender Workload Units (preview), so cost models may shift
Pricing
Billed through Microsoft Defender for Cloud, which is free for the first 30 days. Microsoft's FAQ says Defender for SQL Servers on Machines is billed per protected server, not per database. The public pricing page renders its figures only in the browser, and Microsoft's machine-readable price list shows several Defender for SQL meters (per instance-hour, per vCore-hour and per node-month) without stating which applies to which resource type, so no price is quoted here; check the Defender for Cloud pricing page or the Azure pricing calculator for your resources. A preview billing model in the Defender portal replaces these signals with Defender Workload Units (DWUs) and one Defender for Databases plan.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
Azure-centred teams that want vulnerability scanning and threat alerts on Azure SQL and SQL Server with minimal setup.
Typical use cases
- Getting alerts on SQL injection and brute-force attempts against Azure SQL
- Running recurring vulnerability assessments across all SQL databases in a subscription
- Extending the same protection to on-premises SQL Server through Azure Arc
- Feeding database security alerts into Microsoft Sentinel
Who should look elsewhere
- Oracle estates: see Oracle Data Safe.
- Teams that need blocking or masking in front of the database: see DataSunrise.
Verdict
Defender for SQL is the natural choice for vulnerability assessment and threat detection on Microsoft SQL inside Azure, and Azure Arc stretches it to other environments. It complements, rather than replaces, audit logging and data protection tools, and its billing is moving to a new unit, so recheck costs before you scale out.
Frequently asked questions
What is Defender for SQL called now?
Within Microsoft Defender for Cloud it is two plans under the Defender for Databases plan: Defender for Azure SQL Databases and Defender for SQL Servers on Machines. The preview DWU billing model merges them, and Defender for Open-Source Relational Databases, into one Defender for Databases plan.
How is Defender for SQL priced?
Through Azure consumption billing after a 30-day free trial. Microsoft's FAQ says SQL Servers on Machines is billed per server, not per database. Microsoft publishes several Defender for SQL meters without mapping each to a resource type, so use the Defender for Cloud pricing page or the Azure pricing calculator for current rates.
Can it protect SQL Server outside Azure?
Yes, once the machine is onboarded to Azure Arc and registered as an Azure Arc SQL Server instance. AWS and Google Cloud accounts can also be connected and the plan enabled there.
Does Defender for SQL block attacks?
No. It raises alerts with mitigation guidance and investigation links; blocking needs other controls such as firewalls, permissions or a database firewall product.
Sources
- Microsoft Learn: Defender for Azure SQL Databases overview
- Microsoft Learn: Enable Defender for SQL Servers on Machines
- Microsoft Learn: Defender for Databases FAQ
- Microsoft Learn: Defender Workload Units cost model (preview)
- Microsoft Defender for Cloud pricing
- Azure Retail Prices API (Defender for Cloud meters)
Checked November 2026.
Listed in: Database Security & Auditing.
How we research reviews and what star ratings mean: our editorial method.