Microsoft Defender for open-source relational databases should be enabled

What does the recommendation "Microsoft Defender for open-source relational databases should be enabled" check?

Flags any subscription where the Defender for Cloud plan for open-source relational databases is not set to the Standard tier. This is the plan that turns on threat detection for Azure Database for PostgreSQL Flexible Server and Azure Database for MySQL Flexible Server, the only Azure PaaS deployment model the plan now covers (the single server tiers and Azure Database for MariaDB have all reached retirement, and MariaDB threat protection now applies only to Amazon RDS). It is a subscription-level pricing toggle, not a per-server property, so the check looks at the plan tier and not at any individual database. It does not cover PostgreSQL or MySQL you run yourself on a virtual machine, nor Azure SQL, SQL Managed Instance or Cosmos DB, each of which has its own separate Defender plan.

Why does "Microsoft Defender for open-source relational databases should be enabled" matter?

Open-source databases routinely hold the most sensitive data an organisation owns: customer records, credentials and personal data. Without this plan there is no behavioural detection layer watching for brute-force login storms, access from an unfamiliar location, or query patterns that signal a SQL injection attempt or bulk exfiltration. An attacker who finds a weak password or an exposed firewall rule can then read or drain a database for days before anyone notices, and the first signal is often the data already on a leak site. Enabling Defender gives the security team an alert at the point of compromise rather than after the breach, which is the difference between an incident contained in an hour and a notifiable data breach with regulatory and reputational consequences.

How do I fix "Microsoft Defender for open-source relational databases should be enabled"?

1. Enable the plan for the whole subscription so every current and future supported database is covered: az security pricing create -n 'OpenSourceRelationalDatabases' --tier 'standard'. The Azure portal route is Defender for Cloud, then Environment settings, select the subscription, and switch the 'Databases' plan (or its open-source relational databases component) to On.
2. Confirm it took effect with az security pricing show -n 'OpenSourceRelationalDatabases' --query pricingTier, which should return 'Standard', and check that alerts are reaching the right people under Defender for Cloud email notifications.
3. Make the setting stick across the estate by assigning the built-in policy that configures the plan automatically. Look the definition up by its exact display name rather than hardcoding a GUID: pid=$(az policy definition list --query "[?displayName=='Configure Azure Defender for open-source relational databases to be enabled'].name" -o tsv); az policy assignment create --name enable-defender-ossrdb --policy "$pid" --scope /subscriptions/<subscription-id>, then create a remediation task so existing subscriptions are brought into line.

# Enable the three high-value Defender plans on the current subscription.
# Servers on Plan 2 (adds JIT access, FIM and vulnerability scanning).
az security pricing create --name VirtualMachines \
  --tier Standard --subplan P2

# Storage on the current per-account plan.
az security pricing create --name StorageAccounts --tier Standard

# Azure SQL Database servers (VA + Advanced Threat Protection).
az security pricing create --name SqlServers --tier Standard

# Verify what is now active on this subscription.
az security pricing list \
  --query "value[?pricingTier=='Standard'].name" -o tsv

# Ratchet it shut for the estate: assign the built-in DeployIfNotExists
# policies that turn each plan on for any subscription where it is missing.
# Servers (built-in 'Configure Azure Defender for servers to be enabled').
az policy assignment create \
  --name enable-defender-servers \
  --policy 8e86a5b6-b9bd-49d1-8e21-4bb8a0862222 \
  --scope "/providers/Microsoft.Management/managementGroups/contoso-root"

# Look up the matching Storage and SQL policies by display name rather than
# hard-coding a GUID, then assign each the same way at the same scope.
az policy definition list \
  --query "[?contains(displayName, 'Configure Microsoft Defender for Storage') || contains(displayName, 'Configure Azure Defender to be enabled on SQL servers')].{name:name, displayName:displayName}" \
  -o table