Skip to content

Commit 2286e33

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #280795 from ElazarK/WI265678-sql-at-scale
Create enable-defender-sql-at-scale.md
2 parents bdb84a2 + fd1bb8d commit 2286e33

File tree

2 files changed

+100
-0
lines changed

2 files changed

+100
-0
lines changed

‎articles/defender-for-cloud/TOC.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -855,6 +855,9 @@
855855
- name: Enable Defender for SQL servers on machines
856856
href: defender-for-sql-usage.md
857857
displayName: hybrid, arc, Azure Defender
858+
- name: Enable Defender for SQL servers on machines at scale
859+
displayName: SQL, enable, scale, Defender, machines, SQL server, SQL servers
860+
href: enable-defender-sql-at-scale.md
858861
- name: Migrate to SQL server-targeted Azure Monitoring Agent's autoprovisioning
859862
process
860863
href: defender-for-sql-autoprovisioning.md

‎articles/defender-for-cloud/enable-defender-sql-at-scale.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
title: How to enable Microsoft Defender for SQL servers on machines at scale
3+
description: Learn how to protect your Microsoft SQL servers on Azure VMs, on-premises, and in hybrid and multicloud environments with Microsoft Defender for Cloud at scale.
4+
ms.topic: how-to
5+
ms.author: dacurwin
6+
author: dcurwin
7+
ms.date: 07/31/2024
8+
#customer intent: As a user, I want to learn how to enable Defender for SQL servers at scale so that I can protect my SQL servers efficiently.
9+
---
10+
11+
# Enable Microsoft Defender for SQL servers on machines at scale
12+
13+
Microsoft Defender for Cloud's SQL servers on machines component of the Defender for Databases plan, protects SQL IaaS and Defender for SQL extensions. The SQL servers on machines component identifies and mitigates potential database vulnerabilities while detecting anomalous activity that could indicate threats to your databases.
14+
15+
When [you enable the SQL Server on a machines](tutorial-enable-databases-plan.md#enable-specific-plans-database-protections) component of the Defender for Databases plan, the auto-provision process is it automatically initiated. The auto-provision process installs and configures all the necessary components for the plan to function. Such as the Azure Monitor Agent (AMA), SQL IaaS extension, and Defender for SQL extensions. The auto-provision process also sets up the workspace configuration, Data Collection Rules, identity (if needed), and the SQL IaaS extension.
16+
17+
This page explains how you can enable the auto-provision process for Defender for SQL across multiple subscriptions simultaneously using a PowerShell script. This process applies to SQL servers hosted on Azure VMs, on-premises environments, and Azure Arc-enabled SQL servers. This article also discusses how to utilize extra functionalities that can accommodate various configurations such as:
18+
19+
- Custom data collection rules
20+
21+
- Custom identity management
22+
23+
- Default workspace integration
24+
25+
- Custom workspace configuration
26+
27+
## Prerequisites
28+
29+
- Gain knowledge on:
30+
- [SQL server on VMs](https://azure.microsoft.com/products/virtual-machines/sql-server/)
31+
- [SQL Server enabled by Azure Arc](/sql/sql-server/azure-arc/overview)
32+
- [How to migrate to Azure Monitor Agent from Log Analytics agent](../azure-monitor/agents/azure-monitor-agent-migration.md)
33+
34+
- [Connect AWS accounts to Microsoft Defender for Cloud](quickstart-onboard-aws.md)
35+
- [Connect your GCP project to Microsoft Defender for Cloud](quickstart-onboard-gcp.md)
36+
37+
- Install PowerShell on [Windows](/powershell/scripting/install/installing-powershell-on-windows), [Linux](/powershell/scripting/install/installing-powershell-on-linux), [macOS](/powershell/scripting/install/installing-powershell-on-macos), or [Azure Resource Manager (ARM)](/powershell/scripting/install/powershell-on-arm).
38+
- [Install the following PowerShell modules](/powershell/module/powershellget/install-module):
39+
- Az.Resources
40+
- Az.OperationalInsights
41+
- Az.Accounts
42+
- Az
43+
- Az.PolicyInsights
44+
- Az.Security
45+
46+
- Permissions: requires VM contributor, contributor, or owner rules.
47+
48+
## PowerShell script parameters and samples
49+
50+
The PowerShell script that enables Microsoft Defender for SQL on Machines on a given subscription has several parameters that you can customize to fit your needs. The following table lists the parameters and their descriptions:
51+
52+
| Parameter name | Required | Description |
53+
|--|--|--|
54+
| SubscriptionId: | Required | The Azure subscription ID that you want to enable Defender for SQL servers on machines for. |
55+
| RegisterSqlVmAgnet | Required | A flag indicating whether to register the SQL VM Agent in bulk. <br><br> Learn more about [registering multiple SQL VMs in Azure with the SQL IaaS Agent extension](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-vms-bulk?view=azuresql). |
56+
| WorkspaceResourceId | Optional | The resource ID of the Log Analytics workspace, if you want to use a custom workspace instead of the default one. |
57+
| DataCollectionRuleResourceId | Optional | The resource ID of the data collection rule, if you want to use a custom DCR instead of the default one. |
58+
| UserAssignedIdentityResourceId | Optional | The resource ID of the user assigned identity, if you want to use a custom user assigned identity instead of the default one. |
59+
60+
The following sample script is applicable when you use a default Log Analytics workspace, data collection rule, and managed identity.
61+
62+
```powershell
63+
Write-Host "------ Enable Defender for SQL on Machines example ------"
64+
$SubscriptionId = "<SubscriptionID>"
65+
.\EnableDefenderForSqlOnMachines.ps1 -SubscriptionId $SubscriptionId -RegisterSqlVmAgnet $RegisterSqlVmAgnet
66+
```
67+
68+
The following sample script is applicable when you use a custom Log Analytics workspace, data collection rule, and managed identity.
69+
70+
```powershell
71+
Write-Host "------ Enable Defender for SQL on Machines example ------"
72+
$SubscriptionId = "<SubscriptionID>"
73+
$RegisterSqlVmAgnet = "false"
74+
$WorkspaceResourceId = "/subscriptions/<SubscriptionID>/resourceGroups/someResourceGroup/providers/Microsoft.OperationalInsights/workspaces/someWorkspace"
75+
$DataCollectionRuleResourceId = "/subscriptions/<SubscriptionID>/resourceGroups/someOtherResourceGroup/providers/Microsoft.Insights/dataCollectionRules/someDcr"
76+
$UserAssignedIdentityResourceId = "/subscriptions/<SubscriptionID>/resourceGroups/someElseResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/someManagedIdentity"
77+
.\EnableDefenderForSqlOnMachines.ps1 -SubscriptionId $SubscriptionId -RegisterSqlVmAgnet $RegisterSqlVmAgnet -WorkspaceResourceId $WorkspaceResourceId -DataCollectionRuleResourceId $DataCollectionRuleResourceId -UserAssignedIdentityResourceId $UserAssignedIdentityResourceId
78+
```
79+
80+
## Enable Defender for SQL servers on machines at scale
81+
82+
You can enable Defender for SQL servers on machines at scale by following these steps.
83+
84+
1. Open a PowerShell window.
85+
86+
1. Copy the [EnableDefenderForSqlOnMachines.ps1](https://github.com/Azure/Microsoft-Defender-for-Cloud/blob/fd04330a79a4bcd48424bf7a4058f44216bc40e4/Powershell%20scripts/Enable%20Defender%20for%20SQL%20servers%20on%20machines/EnableDefenderForSqlOnMachines.ps1) script.
87+
88+
1. Paste the script into PowerShell.
89+
90+
1. Enter parameter information as needed.
91+
92+
1. Run the script.
93+
94+
## Next step
95+
96+
> [!div class="nextstepaction"]
97+
> [Scan your SQL servers for vulnerabilities](defender-for-sql-on-machines-vulnerability-assessment.md)

0 commit comments

Comments
 (0)