> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit sql server periodic recurring scans remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On" for AZURE using AZURE console, follow the below steps:

        1. Login to the Azure portal using your credentials.
        2. Navigate to the Security Center dashboard from the left-hand side menu.
        3. Click on the "Security policy" tab from the top menu.
        4. Select the subscription and the scope for which you want to configure the vulnerability assessment settings.
        5. Click on the "Edit" button to edit the security policy.
        6. Scroll down to the "Vulnerability Assessment" section and click on the "On" button for "Periodic recurring scans".
        7. Set the "Recurring scans" frequency as per your requirement.
        8. Click on the "Save" button to save the changes.

        Once the above steps are completed, the vulnerability assessment setting for periodic recurring scans will be turned on and the system will perform periodic scans as per the configured frequency.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On" for Azure using Azure CLI, you can follow the below steps:

        1. Open the Azure CLI command prompt.

        2. Run the following command to enable vulnerability assessment for the specified Azure SQL Server:

           ```
           az sql server va show --resource-group <resource-group-name> --server <server-name> --name default
           ```

           This command will show the current status of vulnerability assessment for the specified Azure SQL Server.

        3. Run the following command to enable periodic recurring scans for the specified Azure SQL Server:

           ```
           az sql server va update --resource-group <resource-group-name> --server <server-name> --name default --email-admins On --email-address <email-address> --state On --recurring-scans-interval 1
           ```

           This command will enable periodic recurring scans for the specified Azure SQL Server with a frequency of 1 day.

        4. Verify the vulnerability assessment settings by running the following command:

           ```
           az sql server va show --resource-group <resource-group-name> --server <server-name> --name default
           ```

           This command will show the updated status of vulnerability assessment for the specified Azure SQL Server.

        By following these steps, you can remediate the misconfiguration "Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On" for Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On" in Azure using Python, you can use the Azure SDK for Python. Here are the steps to remediate the issue:

        1. Install the Azure SDK for Python using the following command:

        ```
        pip install azure-mgmt-security
        ```

        2. Import the necessary modules:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.security import SecurityCenter
        ```

        3. Set up the credentials and the client:

        ```python theme={null}
        TENANT_ID = '<your tenant id>'
        CLIENT_ID = '<your client id>'
        CLIENT_SECRET = '<your client secret>'
        SUBSCRIPTION_ID = '<your subscription id>'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT_ID,
            secret=CLIENT_SECRET,
            tenant=TENANT_ID
        )

        security_center_client = SecurityCenter(credentials, SUBSCRIPTION_ID)
        ```

        4. Get the security policy for your subscription:

        ```python theme={null}
        policy = security_center_client.policies.get('default')
        ```

        5. Update the vulnerability assessment setting to enable periodic recurring scans:

        ```python theme={null}
        vulnerability_assessment_settings = policy.security_contact_configurations.vulnerability_assessment
        vulnerability_assessment_settings.recurring_scans = True

        security_center_client.policies.create_or_update(policy.id, policy)
        ```

        This will enable the vulnerability assessment setting for periodic recurring scans in Azure.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_mssql_server" "SQL_SERVER" {
          name                         = "SQL_SERVER_NAME"
          resource_group_name          = "RESOURCE_GROUP_NAME"
          location                     = "AZURE_REGION"
          version                      = "12.0"
          administrator_login          = "SQL_ADMIN_LOGIN"
          administrator_login_password = "SQL_ADMIN_PASSWORD"
        }

        resource "azurerm_storage_account" "VA_STORAGE" {
          name                     = "VA_STORAGE_ACCOUNT_NAME"
          resource_group_name      = azurerm_mssql_server.SQL_SERVER.resource_group_name
          location                 = azurerm_mssql_server.SQL_SERVER.location
          account_tier             = "Standard"
          account_replication_type = "LRS"
        }

        resource "azurerm_storage_container" "VA_CONTAINER" {
          name                  = "VA-SCAN-RESULTS-CONTAINER" # e.g. "vulnerability-assessment"
          storage_account_name  = azurerm_storage_account.VA_STORAGE.name
          container_access_type = "private"
        }

        data "azurerm_storage_account_sas" "VA_SAS" {
          connection_string = azurerm_storage_account.VA_STORAGE.primary_connection_string
          https_only        = true
          start             = "2025-01-01"
          expiry            = "2030-01-01"

          resource_types {
            service   = true
            container = true
            object    = true
          }

          services {
            blob  = true
            queue = false
            table = false
            file  = false
          }

          permissions {
            read    = true
            write   = true
            delete  = true
            list    = true
            add     = true
            create  = true
            update  = true
            process = false
          }
        }

        resource "azurerm_mssql_server_vulnerability_assessment" "SQL_SERVER_VA" {
          server_security_alert_policy_id = azurerm_mssql_server.SQL_SERVER.id

          storage_container_path = "${azurerm_storage_account.VA_STORAGE.primary_blob_endpoint}${azurerm_storage_container.VA_CONTAINER.name}"
          storage_account_access_key = azurerm_storage_account.VA_STORAGE.primary_access_key

          recurring_scans {
            enabled                   = true
            email_subscription_admins = true
            emails                    = ["SECURITY_TEAM_EMAIL@example.com"]
          }
        }
        ```

        Substitute:

        * `SQL_SERVER_NAME` with your Azure SQL logical server name.
        * `RESOURCE_GROUP_NAME` with the server’s resource group.
        * `AZURE_REGION` with the region of the server, e.g. `"eastus"`.
        * `SQL_ADMIN_LOGIN` / `SQL_ADMIN_PASSWORD` with your admin credentials.
        * `VA_STORAGE_ACCOUNT_NAME` with a globally-unique storage account name.
        * `SECURITY_TEAM_EMAIL@example.com` with one or more security notification emails.

        This change does not force replacement of the SQL server; it adds/updates the server vulnerability assessment configuration to enable periodic recurring scans.

        After applying, `terraform plan` should show creation or update of `azurerm_mssql_server_vulnerability_assessment.SQL_SERVER_VA` with `recurring_scans.enabled` set to `true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>