> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit sqlserver auditing disabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Auditing Disabled for SQL Servers" misconfiguration in Azure using the Azure console, follow these steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)) using your credentials.

        2. Navigate to the Azure SQL Server that you want to remediate.

        3. Click on the "Auditing" option from the left-hand side menu.

        4. In the "Auditing" blade, click on "Enable Auditing".

        5. In the "Audit to" section, select the destination where you want to store the audit logs. You can choose to store the logs in a storage account or log analytics workspace.

        6. In the "Audit logs retention (days)" section, specify the number of days for which you want to retain the audit logs.

        7. In the "Event types to audit" section, select the events that you want to audit. You can choose to audit all events or select specific events.

        8. In the "Storage account settings" or "Log Analytics workspace settings" section, specify the required details for the destination where you want to store the audit logs.

        9. Click on "Save" to enable auditing for the SQL Server.

        10. Verify that auditing is enabled by checking the "Auditing" blade. You should see a message that says "Auditing is enabled".

        That's it! You have successfully remediated the "Auditing Disabled for SQL Servers" misconfiguration in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        Here are the step-by-step instructions to remediate the issue of auditing disabled for SQL Servers on Azure using Azure CLI:

        1. Open the Azure CLI on your local machine or Azure Cloud Shell.

        2. Login to your Azure account using the following command:

        ```
        az login
        ```

        3. Once you are logged in, select the Azure subscription that contains the SQL Server you want to remediate:

        ```
        az account set --subscription <subscription_id>
        ```

        4. Next, check the current auditing status of the SQL Server using the following command:

        ```
        az sql server audit-policy show --resource-group <resource_group_name> --server <server_name>
        ```

        5. If auditing is disabled, you can enable it by running the following command:

        ```
        az sql server audit-policy update --resource-group <resource_group_name> --server <server_name> --state Enabled --storage-account <storage_account_name> --storage-key <storage_account_key> --storage-endpoint <storage_account_endpoint>
        ```

        Note: Replace `<resource_group_name>`, `<server_name>`, `<storage_account_name>`, `<storage_account_key>`, and `<storage_account_endpoint>` with the appropriate values for your environment.

        6. After running the command, wait for a few minutes to allow the changes to propagate.

        7. Finally, verify that auditing is now enabled for the SQL Server using the following command:

        ```
        az sql server audit-policy show --resource-group <resource_group_name> --server <server_name>
        ```

        That's it! You have successfully remediated the misconfiguration of auditing disabled for SQL Servers on Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the issue of auditing being disabled for SQL Servers in Azure using Python, you can use the Azure SDK for Python. Here are the step-by-step instructions:

        1. Install the Azure SDK for Python using pip:

        ```python theme={null}
        pip install azure-mgmt-sql
        ```

        2. Import the necessary modules:

        ```python theme={null}
        from azure.identity import DefaultAzureCredential
        from azure.mgmt.sql import SqlManagementClient
        ```

        3. Authenticate using the default Azure credentials:

        ```python theme={null}
        credential = DefaultAzureCredential()
        subscription_id = 'YOUR_SUBSCRIPTION_ID'
        resource_group_name = 'YOUR_RESOURCE_GROUP_NAME'
        server_name = 'YOUR_SQL_SERVER_NAME'
        ```

        4. Create a `SqlManagementClient` object:

        ```python theme={null}
        sql_client = SqlManagementClient(credential, subscription_id)
        ```

        5. Enable auditing for the SQL Server:

        ```python theme={null}
        from azure.mgmt.sql.models import ServerSecurityAlertPolicy, SecurityAlertPolicyState
        security_alert_policy = ServerSecurityAlertPolicy(state=SecurityAlertPolicyState.enabled)
        sql_client.server_security_alert_policies.create_or_update(resource_group_name, server_name, security_alert_policy_name='default', parameters=security_alert_policy)
        ```

        6. Verify that auditing has been enabled by checking the current state of the security alert policy:

        ```python theme={null}
        current_security_alert_policy = sql_client.server_security_alert_policies.get(resource_group_name, server_name, security_alert_policy_name='default')
        print(current_security_alert_policy.state)
        ```

        These steps will enable auditing for the specified SQL Server in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # SQL Server (resource type: azure-database-sql-server → azurerm_mssql_server)
        resource "azurerm_mssql_server" "sql" {
          name                         = "SQL_SERVER_NAME"          # replace with your server name
          resource_group_name          = azurerm_resource_group.rg.name
          location                     = azurerm_resource_group.rg.location
          version                      = "12.0"
          administrator_login          = "SQL_ADMIN_USERNAME"
          administrator_login_password = "SQL_ADMIN_PASSWORD"

          minimum_tls_version = "1.2"
        }

        # Storage account to hold audit logs
        resource "azurerm_storage_account" "audit" {
          name                     = "AUDITSTORAGEACCOUNTNAME"     # globally unique, 3–24 lower-case letters and numbers
          resource_group_name      = azurerm_resource_group.rg.name
          location                 = azurerm_resource_group.rg.location
          account_tier             = "Standard"
          account_replication_type = "LRS"
        }

        # Enable auditing for the SQL Server (this is what fixes the finding)
        resource "azurerm_mssql_server_extended_auditing_policy" "sql_audit" {
          server_id = azurerm_mssql_server.sql.id

          # Use storage-based auditing
          storage_endpoint                        = azurerm_storage_account.audit.primary_blob_endpoint
          storage_account_access_key              = azurerm_storage_account.audit.primary_access_key
          storage_account_access_key_is_secondary = false

          retention_in_days = 90                   # adjust to your required retention threshold
        }

        # If you prefer Log Analytics-based auditing instead of storage, use this form:
        # resource "azurerm_mssql_server_extended_auditing_policy" "sql_audit" {
        #   server_id                  = azurerm_mssql_server.sql.id
        #   log_analytics_workspace_id = azurerm_log_analytics_workspace.law.id
        #   retention_in_days          = 90
        # }

        # NOTE: Turning auditing on this way does not force replacement of the SQL Server;
        # it is applied in-place.

        ```

        `terraform plan` should show creation of `azurerm_mssql_server_extended_auditing_policy.sql_audit` (and the storage account or Log Analytics workspace if new), with the `state` for that policy moving from `absent` to `present` and auditing enabled on the target SQL Server.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>