Question

A financial services company runs a fleet of Azure SQL Databases containing regulated customer PII. The security architect must design protection that (1) continuously identifies misconfigurations such as excessive permissions and unencrypted columns, and (2) generates alerts on anomalous access patterns like SQL injection and access from unusual locations. The solution must require minimal per-database agent deployment and integrate findings into Microsoft Defender for Cloud. Which capability set should the architect enable?

Accepted Answer

Enable Microsoft Defender for SQL, which provides SQL vulnerability assessment for configuration findings plus Advanced Threat Protection for anomalous-activity alerts, surfaced in Defender for Cloud.

Answer

Enable Transparent Data Encryption with customer-managed keys and rely on Key Vault logging to detect anomalous database access.

Answer

Deploy Microsoft Sentinel data connectors for Azure SQL diagnostic logs and build custom KQL analytics rules for injection detection.

Answer

Enable Microsoft Purview data classification scans and configure DLP policies to block anomalous queries against sensitive columns.