microsoft/TechLab-Module-12-Defender-for-Databases

microsoft/TechLab-Module-12-Defender-for-Databases

License: MIT

Stars: 0

Forks: 1

Open issues: 1

Created: 2026-06-23T20:46:11Z

Pushed: 2026-06-25T17:29:10Z

Default branch: main

Fork: no

Archived: no

README: --- lab: title: TechLab: Module 12 - Defender for Databases description: level: 300 duration: 60 minutes islab: true primarytopics: ---

@lab.Title

Please enter your own Microsoft alias (without the @microsoft.com) in the field below before starting the lab. This information is required to correctly associate your activity with your learner record and ensure your completion is accurately captured and reported. For data integrity and compliance reasons, learners may only enter their own alias. After completing the lab, please allow up to 5 business days for all reporting systems to fully reflect your completion.

@lab.ActivityGroup(aliascapture)

===

Survey

@lab.ActivityGroup(initialsurvey)

===

Introduction

Databases are among the highest-value targets in any cloud environment - they hold customer data, financial records, intellectual property, and credentials. Defender for Cloud's database protection plans give security teams unified visibility across SQL, open-source, and NoSQL databases, whether they're running on Azure VMs, as managed PaaS services, or even in AWS. This lab walks you through enabling that protection, surfacing vulnerabilities, and simulating real attack scenarios so you understand what defenders actually see when something goes wrong.

Objectives

This exercise guides you through Defender for Cloud database protection plans. Database protection in Defender for Cloud includes:

• Defender for SQL IaaS (SQL on Azure VM or outside Azure)
• Defender for SQL PaaS (Azure SQL)
• Defender for Open-source relational databases
• Defender for Cosmos DB (NoSQL)

⌛ Estimated time to complete this lab: 30 minutes

===

Using this Lab

>[!hint] Copy Text Supported > > The fill in fields of this simulation require the exact text be entered to progress. To make that easyer, you can select ++Copy Text++ options in the instructions pane to copy directly into your simulation text entry fields.

---

###Images and diagrams

All images and diagrams in the lab instructions are selectable. Selecting any image opens a zoomed view in a separate window for better clarity and analysis.

---

###Split Window feature

If you're equipped with multiple screens, you can use the Split Window feature to place the lab instructions on a separate screen, making better use of your screen real estate.

To enable this feature:

1. Go to the gear icon in the upper-right corner of the instructions pane.

1. At the bottom of the Settings pane, select Split Windows.


===

Exercise 01: Enable Defender for Databases and validate alerts

Task 01: Enable Defender for Databases

Introduction

Enabling Defender for Databases at the subscription level is the starting point. From here, Defender for Cloud begins assessing your database resources for misconfigurations, vulnerabilities, and threat signals. If you're in a pre-sales conversation, this is worth emphasizing: one toggle covers SQL IaaS, SQL PaaS, open-source relational databases, and Cosmos DB - no separate tooling required per database type.

---

1. From the Azure dashboard, select Microsoft Defender for Cloud.


1. In the left side pane, go to Management, then Environment settings.

1. On the lower side of the page, select Expand all.


1. Select the TechMaster-lod52485614 subscription.


1. Turn on the following:

1. Defender CSPM


1. Select Settings & monitoring.

===

Task 02: Enable extensions on the VM

Introduction

For SQL running on a virtual machine, Defender for Cloud works through two extensions installed directly on the VM: the SQL IaaS Extension (which integrates SQL Server management with Azure) and the MicrosoftDefenderforSQL extension (which handles threat detection and vulnerability assessment). Think of these as the sensors on the ground - without them, Defender has no visibility into what SQL Server is actually doing at the instance level.

---

1. In Azure's top search bar, enter and select ++Resource groups++.

1. Select ResourceGroup1.

>[!note] Your lab's been predeployed with various databases and their associated resources.

1. Select the sqlvm-lab virtual machine.


1. In the leftmost pane, go to Settings, then Extensions + applications.

1. Confirm the following extensions are added:

• MicrosoftDefenderforSQL
• SqlIaasExtension


===

Task 03: View and remediate vulnerability assessments

Introduction

Vulnerability assessments are one of the core proactive capabilities in Defender for Cloud. Rather than waiting for an attack to happen, the scanner continuously checks your SQL configuration against security best practices and surfaces findings as actionable recommendations. For architects, this replaces the need for separate scanning tools. For sales conversations, it's a strong value point: the findings are prioritized, mapped to remediation scripts, and integrated into the same governance workflow as the rest of Defender for Cloud.

>[!alert] In a real environment, you'll need to wait up to 24 hours before proceeding.

Vulnerability assessment will scan your SQL database and surface any deviations, misconfigurations and vulnerabilities. The findings follow the same recommendation structure used across Microsoft Defender for Cloud.

• Each SQL Vulnerability Assessment rule corresponds to its own recommendation.
• Recommendations are associated directly with the affected SQL database resource.
• Each rule can be reviewed, remediated, or marked as baseline independently.

Read more about it here: https://learn.microsoft.com/en-us/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview

The new approach to viewing vulnerability assessment findings is through the following database-level recommendations experience.

---

###...