Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Express Configuration Vulnerability Findings - Microsoft Defender for Cloud | Microsoft Learn

29 September 2026Doc update+22 / −22 lines

In brief

The documentation was edited for clearer wording, formatting, and navigation across Express/Classic configuration guidance, scan history, finding exclusions, Logic Apps notifications, API usage, and Resource Manager baseline examples.

What Defender admins need to know

Administrators can follow the revised instructions more easily; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Express configuration vulnerability findingsConfiguration Vulnerability Findings - Microsoft Defender for Cloud | Microsoft Learn

Microsoft Defender for Cloud provides vulnerability assessment for your Azure SQL databases. Scans detect software vulnerabilities and return findings. You can remediate vulnerabilities or disable findings when needed.

Before you begin, confirm which configuration model your environment uses.

  • Make sureBefore you knowcontinue, find out whether you're using use the express or classic configuration model before you continue..

    To see which configuration you're using: use:

    1. In the Azure portal, open the specific resource in Azure SQL Database, Azure SQL Managed Instance, or Azure Synapse.
    2. Under the Security heading, select Defender for Cloud.

Express Configuration is generally available for Azure SQL Managed Instance and Azure Synapse Analytics Workspaces. Express Configuration extends the generally available Microsoft-managed experience for Azure SQL Database, at no additional cost.

By using Express Configuration allowsConfiguration, you tocan enable SQL VA without configuringsetting up a customer-managed storage account. Express Configuration is the recommended enablement mode andmode. It provides the same security value as Classic Configuration but with a simplifiedsimpler setup.

A unified REST API (v2026-04-01-preview) manages SQL VA consistently across Azure SQL Database, SQL Managed Instance, Synapse Workspaces, and SQL on machines (Azure VM and Arc-enabled SQL).

View scan history

In the Azure portal, open your database resource and under Security, select Defender for Cloud under Security to open the vulnerability assessment pane. Select Scan History to view a history of all scans previously run on this database.

Express configuration doesn't store scan results if they're identical to previous scans. The scan time shown in the scan history is the time of the last scan where the scan results changed.

Disable specific findings from Microsoft Defender for Cloud (preview)

If you have an organizational needyour organization needs to ignore a finding rather than remediate it, you can disable the finding. Disabled findings don't impact your secure score or generate unwanted noise. You can see disabled findings in the "Not applicable" section of the scan results.

When a finding matches the criteria you've defined define in your disable rules, it wondoesn't appear in the list of findings. Typical scenarios might include:

  • Disable findings with medium or lower severity
  • Disable findings that are non-patchable

Important

To disable specific findings, you need permissions to edit a policy in Azure Policy. LearnFor more ininformation, see Azure RBAC permissions in Azure Policy.

To create a rule, go to Microsoft Defender for Cloud in the Azure portal and select Recommendations to find the relevant recommendation.

Configure email notifications using Azure Logic Apps

To receive regular updates ofabout the vulnerability assessment status for your database, you can use the customizable Azure Logic Apps template.

UsingBy using the customizable Azure Logic Apps template lets you:template, you can:

  • Choose the timing ofwhen to send the email reports.
  • Have a consistent view of your vulnerability assessment status that includes disabled rules.
  • Send reports for Azure SQL Servers and SQL VMs.
  • Customize the report structure and appearance to match your organizational standards.

Manage vulnerability assessments programmatically

You can manage SQL vulnerability assessment programmatically by using REST APIs, Azure Resource Manager templates, PowerShell, or Azure CLI.

Unified SQL vulnerability assessment API (recommended)

TheUse the unified SQL vulnerability assessment API version 2026-04-01-preview is recommended for Azure SQL Database, Azure SQL Managed Instance, Azure Synapse Analytics workspaces, and SQL on machines.

Use the ARM template for Azure SQL logical server with express configuration to create a new Azure SQL logical server with express configuration for SQL vulnerability assessment.

To configure vulnerability assessment baselines by using Azure Resource Manager templates, use the Microsoft.Sql/servers/databases/sqlVulnerabilityAssessments/baselines type. Make sureEnsure that vulnerabilityAssessments is enabled before you add baselines.

The following examples show how to set up baselines by using ARM templates:

  • SetupSet up a batch baseline based on the latest scan results:results.

    {
        }
}

  • Set up batch baseline based on specific results:results.

    {
  }
}

  • Set up baseline for a specific rule:rule.

    {
    }
}

  • Set up batch baselines on the master database based on the latest scan results:results.

    {

Manage vulnerability assessments with PowerShell

Express configuration isnPowerShell cmdlets don't supported in PowerShell cmdlets,support express configuration, but you can use PowerShell to invokecall the REST API and access the latest vulnerability assessment capabilities by using the REST API.features. For example, you can:

Manage vulnerability assessments with Azure CLI