> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor SQL Encryption setting is not enabled

### More Info:

Enable SQL Encryption recommendations for virtual machines.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* HIPAA
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Monitor SQL Encryption setting is not enabled" misconfiguration in AZURE using the AZURE console, follow the below steps:

        1. Login to the AZURE portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the "SQL servers" option from the left navigation pane.
        3. Select the SQL server for which you want to enable the encryption setting.
        4. Click on the "Security" option from the left navigation pane.
        5. Select the "Auditing & Threat detection" option.
        6. Click on the "Advanced Threat Protection" option.
        7. Scroll down to the "SQL Advanced Threat Protection" section.
        8. Click on the "Edit" button.
        9. Enable the "Monitor SQL Encryption setting" option.
        10. Click on the "Save" button to save the changes.

        Once the above steps are completed, the "Monitor SQL Encryption setting is not enabled" misconfiguration will be remediated in AZURE.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Monitor SQL Encryption setting is not enabled" misconfiguration in Azure using Azure CLI, follow the below steps:

        Step 1: Open Azure CLI and login to your Azure account using the command:

        ```
        az login
        ```

        Step 2: Once you are logged in, set the Azure subscription where your SQL Server is located using the command:

        ```
        az account set --subscription <subscription_id>
        ```

        Step 3: Check if the SQL Encryption setting is enabled or not using the command:

        ```
        az sql server tde show --resource-group <resource_group_name> --server <sql_server_name> --database <database_name>
        ```

        Step 4: If the SQL Encryption setting is not enabled, enable it using the command:

        ```
        az sql server tde set --status Enabled --resource-group <resource_group_name> --server <sql_server_name> --database <database_name>
        ```

        Step 5: Verify that the SQL Encryption setting is enabled by running the command in Step 3 again.

        By following these steps, you can remediate the "Monitor SQL Encryption setting is not enabled" misconfiguration in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Monitor SQL Encryption setting is not enabled" misconfiguration in Azure using Python, you can follow the below steps:

        1. Import the necessary libraries:

        ```python theme={null}
        from azure.identity import DefaultAzureCredential
        from azure.mgmt.security import SecurityCenter
        ```

        2. Authenticate to Azure using the `DefaultAzureCredential` class:

        ```python theme={null}
        credential = DefaultAzureCredential()
        ```

        3. Instantiate the `SecurityCenter` client using the credential:

        ```python theme={null}
        security_center_client = SecurityCenter(
            credential=credential,
            subscription_id="<subscription_id>"
        )
        ```

        4. Get the security policy for SQL encryption:

        ```python theme={null}
        policy = security_center_client.security_policies.get(
            resource_group_name="<resource_group_name>",
            security_policy_name="<security_policy_name>"
        )

        sql_encryption_setting = next(
            (setting for setting in policy.settings if setting.name == "sqlEncryption"),
            None
        )
        ```

        5. If the `sqlEncryption` setting is not enabled, enable it and update the security policy:

        ```python theme={null}
        if sql_encryption_setting and not sql_encryption_setting.value:
            sql_encryption_setting.value = True
            policy = security_center_client.security_policies.create_or_update(
                resource_group_name="<resource_group_name>",
                security_policy_name="<security_policy_name>",
                security_policy=policy
            )
        ```

        The above steps will remediate the "Monitor SQL Encryption setting is not enabled" misconfiguration in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Ensure the AzureRM provider is configured separately with the correct subscription/tenant.
        provider "azurerm" {
          features {}
        }

        data "azurerm_subscription" "current" {}

        # Policy assignment enabling the "Monitor SQL Encryption" recommendation in Defender for Cloud
        resource "azurerm_policy_assignment" "monitor_sql_encryption" {
          name                 = "monitor-sql-encryption"
          display_name         = "Monitor SQL Encryption on Virtual Machines"
          scope                = data["azurerm_subscription"]["current"]["id"]
          policy_definition_id = "POLICY_DEFINITION_ID_FOR_MONITOR_SQL_ENCRYPTION"

          # If the built‑in policy requires parameters, define them here, for example:
          # parameters = jsonencode({
          #   effect = {
          #     value = "AuditIfNotExists"
          #   }
          # })
        }
        ```

        Substitute `POLICY_DEFINITION_ID_FOR_MONITOR_SQL_ENCRYPTION` with the full resource ID of the built‑in Azure Policy (or initiative) that turns on the “Monitor SQL Encryption” recommendation in Microsoft Defender for Cloud (Azure Security Center) for virtual machines, e.g. copied from the Azure Portal’s Policy blade.

        Changing `policy_definition_id` on an existing `azurerm_policy_assignment` forces replacement of that policy assignment; any dependent processes relying on the old assignment will see it removed and the new one created.

        For verification, `terraform plan` should show this policy assignment being created (or updated/replaced if you are modifying an existing one), with the `policy_definition_id` set to the desired “Monitor SQL Encryption” policy and the `scope` matching the subscription or management group where you want the recommendation enforced.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>