SQL managed instances should have vulnerability assessment configured

What does the recommendation "SQL managed instances should have vulnerability assessment configured" check?

Flags any Azure SQL Managed Instance that has no vulnerability assessment scanning configured, so recurring scans for security misconfigurations, excessive permissions and exposed sensitive data never run. It checks that the assessment is set up at the managed instance level, either via Defender for Cloud's express configuration or a classic configuration backed by a storage account. It does not verify that individual findings have been remediated, that a baseline has been approved, or that the weekly scan actually completed, only that an assessment is configured at all. It is also separate from the recommendation to enable the Defender for Azure SQL plan itself, though enabling that plan is the usual way this control gets satisfied.

Why does "SQL managed instances should have vulnerability assessment configured" matter?

A managed instance carries production databases, and without recurring assessment you have no systematic view of weak settings: over-broad logins, missing Transparent Data Encryption, surface area left open after a migration, or sensitive columns nobody flagged. These accumulate silently between releases. When an attacker or an auditor finds them first, the consequence is a reportable exposure of regulated data or a failed compliance attestation, both of which carry direct financial and contractual cost. Configured assessment turns that blind spot into a weekly, prioritised list your team can actually work through.

How do I fix "SQL managed instances should have vulnerability assessment configured"?

1. Enable the Microsoft Defender for Azure SQL plan on the subscription, which auto-configures vulnerability assessment in express mode for managed instances at no extra storage cost: 'az security pricing create --name SqlServers --tier Standard'. Express mode lets Defender for Cloud hold the scan results, so no customer storage account is needed.
2. If you require classic configuration (results in your own storage), provision a Standard GPv1 or GPv2 storage account in the same region as the instance, run 'Enable-AzSqlInstanceAdvancedDataSecurity -ResourceGroupName <rg> -InstanceName <mi>' as the prerequisite, then run the PowerShell cmdlet 'Update-AzSqlInstanceVulnerabilityAssessmentSetting -ResourceGroupName <rg> -InstanceName <mi> -StorageAccountName <name> -ScanResultsContainerName vulnerability-assessment -RecurringScansInterval Weekly'. The cmdlet resolves the storage account by name in the instance's subscription; alternatively pass '-BlobStorageSasUri <sas-uri>' to a results container instead of '-StorageAccountName'.
3. Enforce it across the estate by assigning the built-in policy by its exact display name rather than a hardcoded id: pid=$(az policy definition list --query "[?displayName=='Vulnerability assessment should be enabled on SQL Managed Instance'].name" -o tsv); az policy assignment create --name sqlmi-va --policy "$pid" --scope <subscription-scope>.

# Step 1: close coverage gaps. Enable the scanning plans on the subscription.
SUB="/subscriptions/00000000-0000-0000-0000-000000000000"

az security pricing create --name VirtualMachines --tier Standard
az security pricing create --name SqlServers       --tier Standard
az security pricing create --name Containers       --tier Standard

# Step 2: list the machines that still have no assessment solution attached.
az security assessment list \
  --query "[?metadata.displayName=='Machines should have a vulnerability assessment solution' && status.code=='Unhealthy'].resourceDetails.id" \
  -o tsv

# Step 3: ratchet it shut. Enforce that the plans stay enabled estate-wide,
# so no new subscription can become an unscanned blind spot. Assign the
# built-in initiative 'Configure Microsoft Defender for Cloud plans'
# (DeployIfNotExists), which turns the Servers, SQL and Containers plans
# back on wherever they are missing.
az policy assignment create \
  --name enable-defender-plans \
  --display-name "Configure Microsoft Defender for Cloud plans" \
  --policy-set-definition f08c57cd-dbd6-49a4-a85e-9ae77ac959b0 \
  --scope "$SUB" \
  --mi-system-assigned --location uksouth