Merge pull request #111770 from VanMSFT/VAStorage

VA storage behind firewalls and VNets

Author: v-albemi

articles/sql-database/media/sql-database-vulnerability-assessment-storage/mi-service-endpoint.png

@@ -0,0 +1,60 @@
+---
+title: Store Vulnerability Assessment scan results in a storage account accessible behind firewalls and VNets
+description: "Provides instructions on how to store Vulnerability Assessment (VA) scans in a storage account that can be accessed through a firewall or a VNet"
+services: sql-database
+ms.service: sql-database
+ms.subservice: security
+ms.topic: conceptual
+author: barmichal
+ms.author: mibar
+ms.reviewer: vanto
+ms.date: 04/17/2020
+---
+
+# Store Vulnerability Assessment scan results in a storage account accessible behind firewalls and VNets
+
+If you are limiting access to your storage account in Azure for certain VNets or services, you'll need to enable the appropriate configuration so that Vulnerability Assessment (VA) scanning for SQL Databases or Managed Instances have access to that storage account.
+
+## Enable Azure SQL Database VA scanning access to the storage account
+
+If you have configured your VA storage account to only be accessible by certain networks or services, you'll need to ensure that VA scans for your Azure SQL Database are able to store the scans on the storage account. To find out which storage account is being used, go to your **SQL server** pane in the [Azure portal](https://portal.azure.com), under **Security**, select **Advanced data security**.
+
+:::image type="content" source="media/sql-database-vulnerability-assessment-storage/va-storage.png" alt-text="va-storage":::
+
+You can use the existing storage account, or create a new storage account to store VA scan results for all databases on your Azure SQL Server.
+
+Go to your **Resource group** that contains the storage account and access the **Storage account** pane. Under **Settings**, select **Firewall and virtual networks**.
+
+Ensure that **Allow trusted Microsoft services access to this storage account** is checked.
+
+:::image type="content" source="media/sql-database-vulnerability-assessment-storage/storage-allow-microsoft-services.png" alt-text="storage-allow-microsoft-services":::
+
+## Store VA scan results for Azure SQL Managed Instance in a storage account that can be accessed behind a firewall or VNet
+
+Since Managed Instance is not a trusted Microsoft Service and has a different VNet from the storage account, executing a VA scan will result in an error.
+
+To support VA scans on Managed Instances, follow the below steps:
+
+1. In the **SQL managed instance** pane, under the **Overview** heading, click the **Virtual network/subnet** link. This takes you to the **Virtual network** pane.
+
+   :::image type="content" source="media/sql-database-managed-instance-public-endpoint-configure/mi-overview.png" alt-text="mi-overview2":::
+
+1. Under **Settings**, select **Subnets**. Click **Subnet** in the new pane to add a subnet, and delegate it to *Microsoft.sql\managedInstance*. For more information, see [Manage subnets](../virtual-network/virtual-network-manage-subnet.md).
+
+   :::image type="content" source="media/sql-database-vulnerability-assessment-storage/mi-subnets.png" alt-text="mi-subnets":::
+
+1. In your **Virtual network** pane, under **Settings**, select **Service endpoints**. Click **Add** in the new pane, and add the *Microsoft.Storage* Service as a new service endpoint. Make sure the *ManagedInstance* Subnet is selected. Click **Add**.
+
+   :::image type="content" source="media/sql-database-vulnerability-assessment-storage/mi-service-endpoint.png" alt-text="mi-service-endpoint":::
+
+1. Go to your **Storage account** that you've selected to store your VA scans. Under **Settings**, select **Firewall and virtual networks**. Click on **Add existing virtual network**. Select your managed instance virtual network and subnet, and click **Add**.
+
+   :::image type="content" source="media/sql-database-vulnerability-assessment-storage/storage-firewall.png" alt-text="storage-firewall":::
+
+You should now be able to store your VA scans for Managed Instances in your storage account.
+
+## Next steps
+
+- [Vulnerability Assessment](sql-vulnerability-assessment.md)
+- [Create an Azure Storage account](../storage/common/storage-account-create.md)
+- [Advanced data security for Azure SQL Database](sql-database-advanced-data-security.md)

articles/sql-database/media/sql-database-vulnerability-assessment-storage/mi-subnets.png

@@ -128,7 +128,11 @@
       - name: Data discovery and classification
         href: sql-database-data-discovery-and-classification.md
       - name: Vulnerability assessment
-        href: sql-vulnerability-assessment.md
+        items:
+        - name: Vulnerability assessment  
+          href: sql-vulnerability-assessment.md
+        - name: Storing VA scans behind firewalls and VNets
+          href: sql-database-vulnerability-assessment-storage.md
       - name: Advanced Threat Protection
         href: sql-database-threat-detection-overview.md
       - name: Security attributes