What is IT AMC in the USA and why do businesses need it?

IT AMC (Annual Maintenance Contract) in the USA is a comprehensive service agreement for maintaining all IT equipment and systems. Businesses need IT AMC for predictable costs, 24/7 support, preventive maintenance, reduced downtime, and expert technical assistance. It's the most affordable way to ensure reliable IT operations.

How much does IT AMC cost in the USA?

IT AMC pricing in the United States is scoped per engagement and depends on the number of devices, support level, and services included. Small businesses with basic coverage sit at the entry level, and comprehensive packages scale with the size of your estate. We offer the best affordable IT AMC solutions in United States with customized pricing.

What is included in managed IT services in the USA?

Our managed IT services in the USA include complete IT infrastructure management, 24/7 monitoring and support, cybersecurity, cloud services, backup and disaster recovery, help desk support, network management, and proactive maintenance. It's a complete IT department solution with affordable monthly pricing.

What is the response time for IT support in the USA?

GR IT Services responds to P1 critical issues in 5 minutes for managed clients, delivered remotely. We offer 24/7 reliable IT support to businesses across the USA with a guaranteed SLA.

Which areas in the USA does GR IT Services cover?

We provide IT support and managed IT services across all major USA cities including New York, Los Angeles, Chicago, Houston, Phoenix, Philadelphia, San Antonio, San Diego, Dallas, and San Jose. We serve businesses nationwide with complete IT support.

Why is GR IT Services the best IT company in the USA?

GR IT Services combines reliable 24/7 support, a 5-minute P1 response SLA, complete IT solutions, and certified Microsoft CSP and Apple Jamf partner status. We provide IT AMC and managed IT services across the USA with a guaranteed SLA and senior engineers on every engagement.

Microsoft Defender for SQL for US businesses

Retirement of the classic SQL vulnerability assessment APIs happens on 16 August 2027, and express configuration is where everybody is expected to end up.

The date is published, and express configuration does away with the customer-managed storage account altogether. It is the recommended enablement mode, delivers identical security value through a simpler setup, and extends the Microsoft-managed experience without additional cost. Where your databases hold customer records governed by HIPAA, GLBA or a state privacy law, this migration is one to do early rather than to leave until the deadline is close.

Book a SQL security review See what it covers

Microsoft Defender for SQL for US organizations

16 Aug 2027Classic vulnerability assessment API retirement
No storageExpress needs no customer-managed account
SQL 2012 to 2022Server versions protected, plus Azure SQL
Subscription wideExisting and future resources protected

What Defender for SQL does

Eight things that determine how much value this actually returns.

Two distinct jobs get done here. One finds configuration weaknesses inside your databases. The other detects attacks against them. Most businesses enable the plan and then use only the second, because the first depends on a baseline nobody ever set.

Coverage across Azure SQL and SQL Server

Coverage runs to read and write replicas of Azure SQL single databases and elastic pools, Azure SQL managed instances, and Azure Synapse Analytics dedicated SQL pools. On the server side it reaches SQL Server 2012 through 2022, SQL Server running on Azure Virtual Machines, and SQL Server enabled by Azure Arc.

Enablement that covers what comes next

Enabling the plan protects every supported resource in that subscription, and anything created there afterwards is protected too. That inheritance is what keeps coverage from decaying as project teams spin up new databases, which is otherwise a gap that never closes.

Vulnerability assessment against a rule knowledge base

Built into Azure SQL is a scanning service running against a knowledge base of rules, flagging security vulnerabilities and departures from best practice at both database and server level. That includes misconfigurations, permissions granted too broadly, and sensitive data left unprotected.

Baselines, which is where the value actually is

The assessment report can be tailored to your environment by setting an acceptable baseline covering permission configurations, feature configurations and database settings. Skip the baseline and every deliberate design decision specific to your environment reappears as a finding month after month, at which point somebody stops reading the report entirely.

Threat protection for the attacks that matter

Advanced Threat Protection watches continuously for potential SQL injection attempts, for anomalous database access and query patterns such as an unusually high number of failed sign-ins using different credentials, and for suspicious activity of the kind where access arrives from a machine that has been talking to a crypto-mining command and control server.

The classic API retirement date

Both the APIs used to configure classic vulnerability assessment and the classic Advanced Threat Protection APIs retire on 16 August 2027. Anyone still running classic therefore has a fixed deadline and a documented migration path, rather than a choice they can defer indefinitely.

What express configuration changes

The customer-managed storage account requirement disappears entirely. Defender for Cloud handles the storage itself, keeping results in the same Azure region as the logical SQL server. It is described as the recommended enablement mode, delivering identical security value through a simplified setup.

Baseline behavior differs between the two models

Under express configuration a baseline takes effect the moment you apply it, with no rescan required. Under classic it takes effect only once the database has been rescanned. That single difference transforms how quickly a tuning session converges, and beyond the storage account question it is the most practical argument for moving to express.

A dated migration, not an optional one

On 16 August 2027 both the classic vulnerability assessment and Advanced Threat Protection APIs retire.

Both the date and the migration guidance are published, which makes this among the easier deadlines to plan a piece of work around.

The APIs behind classic vulnerability assessment configuration go on that date, and the classic Advanced Threat Protection APIs go with them. Anything automating configuration through either, whether that is infrastructure as code or a script somebody wrote years ago, has to move before then.
Express configuration is where you are heading, and it is already generally available for Azure SQL Managed Instance and Azure Synapse Analytics Workspaces, extending the generally available Microsoft-managed experience from Azure SQL Database without additional cost.
None of the practical gains wait for the deadline. Express gets rid of the customer-managed storage account, simplifies the permissions required to change a setting, lets baselines be set in batch and from the latest scan results, and applies a baseline with no rescan needed.
There are trade-offs, and they are genuine but minor. Express scopes policy at subscription and server level rather than at database level, caps a single rule scan result at 1 MB where classic had no limit, and exports to CSV instead of Excel. For nearly every estate those are a fair exchange for removing the storage dependency entirely.

Ask us to plan the express migration

How we approach it

Four things that turn this into more than a checkbox somebody ticked.

Value comes out of this product in two directions, and businesses reliably capture only one of them. The vulnerability assessment half is where the effort lives, and it is also where the durable improvement comes from.

We baseline before we report

The assessment can be tailored by setting an acceptable baseline across permission configurations, feature configurations and database settings. Without one, every deliberate design decision in your environment comes back as a finding on every scan, and the report degrades into noise inside two cycles.

We move to express configuration now

Classic vulnerability assessment APIs retire on 16 August 2027 alongside the classic Advanced Threat Protection APIs. Express removes the storage account, simplifies permissions, supports batch baselines and applies them without a rescan. There is no reason to wait for the deadline to collect those benefits.

We include the SQL nobody counts

SQL Server on Azure Virtual Machines and SQL Server enabled by Azure Arc are both protected, and both are routinely missed because the estate inventory was built from the Azure SQL resource list. Those instances frequently hold the older and less well maintained databases.

We make sure somebody receives the alerts

Threat protection detects SQL injection attempts, brute force patterns and access from compromised hosts, with mitigation guidance and a Sentinel investigation path. All of that assumes a named responder. Alerts arriving in an unwatched queue are indistinguishable from no detection at all.

How an engagement runs

Four phases across roughly four to six weeks.

Enabling it is fast, since it applies across the whole subscription at once. Where the time goes is into baselining, and baselining is what turns a long list of findings into a report somebody will still be reading next month.

01
Week 1
Inventory the SQL estate and enable
We inventory the Azure SQL databases, the elastic pools, the managed instances, the Synapse dedicated pools, SQL Server running on virtual machines and Arc-enabled SQL Server. The plan then goes on at subscription level, so existing and future resources are covered without anyone having to remember to add them.
- SQL estate inventory across subscriptions
- Plan enabled at subscription scope
- Arc-enabled and VM-hosted SQL identified
- Current configuration model established, express or classic
02
Week 2
Move to express configuration
Where classic is still in place, we migrate it, which removes the customer-managed storage account dependency and simplifies the permissions needed to change a setting. Doing that now rather than closer to the August 2027 API retirement makes sense purely because the operational benefits arrive immediately.
- Express configuration enabled per resource type
- Storage account dependency removed
- Automation using classic APIs identified for migration
- Permissions model updated
03
Weeks 3 to 4
Baseline the findings against your environment
This is the phase deciding whether the report is worth anything. Baselines get set across permission configurations, feature configurations and database settings, so that decisions specific to your environment stop reappearing as findings every cycle. Because express applies a baseline without requiring a rescan, the work becomes iterative rather than slow.
- Findings triaged with the database team
- Baselines set for accepted configurations
- Genuine findings assigned owners and dates
- Remaining report reviewed for readability
04
Weeks 5 to 6
Route alerts and connect to investigation
Threat protection alerts get routed to whoever actually responds, the Sentinel investigation path is confirmed to work, and vulnerability findings go into a recurring review so the baseline moves with the estate instead of setting hard.
- Alerts routed to a named responder
- Sentinel investigation path confirmed
- Recurring vulnerability review scheduled
- Baseline maintenance owner assigned

Where this matters

Six situations where the database is the target.

The recurring shape is a business with solid network and endpoint controls whose databases were secured properly on the day they went live and never looked at again.

A business with a customer-facing application

Every application that accepts input and queries a database is a candidate for SQL injection, and Advanced Threat Protection detects potential injection attacks including the cases where an application itself generates a faulty SQL statement. That detection is the direct control for the most persistent risk in web applications.

A regulated firm asked about database configuration

The assessment reaches both database-level and server-level issues, taking in server firewall settings and server-level permissions, and it hands back remediation steps you can act on plus customized scripts where those apply. What that produces is evidence shaped the way a SOC 2 auditor, a bank examiner working through GLBA and FTC Safeguards expectations, or an insurer actually asks for it, rather than a general assurance somebody wrote.

An organization with excessive database permissions

Permissions granted too broadly are flagged explicitly by the rule knowledge base, sitting alongside misconfigurations and unprotected sensitive data. They are also the category that builds up in silence, because permissions get granted during a project and taken away almost never.

A HIPAA-covered provider running older SQL Server versions

SQL Server 2012 through 2022 is covered, including instances on Azure Virtual Machines and those enabled by Arc. Healthcare estates frequently carry older versions because a clinical application demands it, and in that situation detection plus vulnerability assessment are what make the decision manageable rather than merely accepted. They also generate the monitoring evidence a HIPAA security risk analysis expects to see.

A company still using classic configuration

Both sets of classic APIs, vulnerability assessment and Advanced Threat Protection alike, retire on 16 August 2027. Anything automating configuration through either has to move before then, and express configuration is worth adopting for its immediate operational benefits rather than simply to satisfy a date.

A business whose database estate keeps growing

Switching the plan on protects every supported resource in that subscription plus anything created there later. In a business where project teams create databases regularly, that automatic inclusion is worth more than any single detection capability in the product.

Three positions

How US organizations secure their SQL estate.

Most organizations sit in the middle column. The plan is enabled, the alerts arrive, and the vulnerability assessment report has never once been triaged because nobody got round to baselining it.

SQL injection detection

Enabled, express, baselinedYes

Enabled, not baselinedYes

Not enabledNo

Brute force detection

Enabled, express, baselinedYes

Enabled, not baselinedYes

Not enabledNo

Vulnerability findings produced

Enabled, express, baselinedYes

Enabled, not baselinedYes

Not enabledNo

Findings actually triaged

Enabled, express, baselinedYes

Enabled, not baselinedNo

Not enabledNot applicable

Environment baselined

Enabled, express, baselinedYes

Enabled, not baselinedNo

Not enabledNot applicable

Storage account dependency

Enabled, express, baselinedNone

Enabled, not baselinedLikely still present

Not enabledNot applicable

Ready for the 2027 API retirement

Enabled, express, baselinedYes

Enabled, not baselinedNot yet

Not enabledNot applicable

Future databases covered

Enabled, express, baselinedAutomatically

Enabled, not baselinedAutomatically

Not enabledNo

Alerts routed to a responder

Enabled, express, baselinedYes

Enabled, not baselinedSometimes

Not enabledNot applicable

Report read next month

Enabled, express, baselinedYes

Enabled, not baselinedNo

Not enabledNot applicable

Feature	Enabled, express, baselined	Enabled, not baselined	Not enabled
SQL injection detection	Yes	Yes	No
Brute force detection	Yes	Yes	No
Vulnerability findings produced	Yes	Yes	No
Findings actually triaged	Yes	No	Not applicable
Environment baselined	Yes	No	Not applicable
Storage account dependency	None	Likely still present	Not applicable
Ready for the 2027 API retirement	Yes	Not yet	Not applicable
Future databases covered	Automatically	Automatically	No
Alerts routed to a responder	Yes	Sometimes	Not applicable
Report read next month	Yes	No	Not applicable

Express against classic

Ten documented differences between the two configuration models.

Drawn from the published comparison table. The baseline rows are what change your day to day work, while the storage row is the one that changes the architecture underneath it.

Parameter

Storage dependency

Express configuration: None, Microsoft managed
Classic configuration: A customer-managed Azure storage account

Parameter

Applying a baseline

Express configuration: Takes effect without rescanning
Classic configuration: Takes effect only after rescanning

Parameter

Baseline settings

Express configuration: Batch, from latest results, or single rule
Classic configuration: Single rule only

Parameter

Recurring scan

Express configuration: Always active
Classic configuration: Configurable on or off

Parameter

Scan scheduling

Express configuration: Internal, not configurable
Classic configuration: Internal, not configurable

Parameter

Policy scope

Express configuration: Subscription and server
Classic configuration: Subscription, server and database

Parameter

Single rule scan result size

Express configuration: Maximum of 1 MB
Classic configuration: Unlimited

Parameter

Scan export

Express configuration: CSV and Azure Resource Graph
Classic configuration: Excel format and Azure Resource Graph

Parameter

Permissions to change settings

Express configuration: SQL Security Manager or security admin
Classic configuration: Plus Storage Blob Data Reader and storage account Owner

Parameter

Data residency

Express configuration: Same region as the logical SQL server
Classic configuration: Wherever the storage account is

Parameter	Express configuration	Classic configuration
Storage dependency	None, Microsoft managed	A customer-managed Azure storage account
Applying a baseline	Takes effect without rescanning	Takes effect only after rescanning
Baseline settings	Batch, from latest results, or single rule	Single rule only
Recurring scan	Always active	Configurable on or off
Scan scheduling	Internal, not configurable	Internal, not configurable
Policy scope	Subscription and server	Subscription, server and database
Single rule scan result size	Maximum of 1 MB	Unlimited
Scan export	CSV and Azure Resource Graph	Excel format and Azure Resource Graph
Permissions to change settings	SQL Security Manager or security admin	Plus Storage Blob Data Reader and storage account Owner
Data residency	Same region as the logical SQL server	Wherever the storage account is

How an engagement runs

Five steps, and it is the baseline that decides whether any of it lasts.

Enabling it takes minutes and covers everything you have now plus everything you build later. Making the findings genuinely useful takes a couple of weeks, and that work is what separates a control from a report.

1
Inventory the whole SQL estate
That means Azure SQL databases and elastic pools, managed instances and Synapse dedicated pools, alongside SQL Server running on Azure Virtual Machines and Arc-enabled SQL Server. Those final two are supported and routinely left out of the inventory, and they are frequently where the oldest databases in the environment are sitting.
2
Enable at subscription level
Every supported resource in the subscription becomes protected, and so does anything created there afterwards. That automatic inclusion is precisely what stops coverage drifting as teams stand up databases without mentioning it to anyone.
3
Move to express configuration
We remove the customer-managed storage account along with the extra permissions it demands, well ahead of the classic API retirement on 16 August 2027. Express additionally supports setting baselines in batch and applies them without requiring a rescan, both of which make the next step considerably quicker.
4
Baseline against your actual environment
Findings get triaged alongside your database team, with the configurations you deliberately chose recorded as a baseline covering permission configurations, feature configurations and database settings. What survives that process is the genuine finding list, and every item on it receives an owner and a date.
5
Route alerts and keep the baseline current
Threat protection alerts reach a named responder, the Sentinel investigation path is confirmed rather than assumed, and a recurring review keeps the baseline reflecting the environment as it is today rather than as it was the last time somebody looked at it.

Straight answers

What US organizations ask about Defender for SQL.

On the Azure side, read and write replicas of single databases and elastic pools, managed instances, and Azure Synapse Analytics dedicated SQL pools. On the server side, SQL Server 2012 through 2022, SQL Server running on Azure Virtual Machines, and SQL Server enabled by Azure Arc.

You do not. Enabling Defender for Azure SQL Databases protects every supported resource inside that subscription, and it protects anything created there subsequently as well. That automatic inclusion is among the stronger arguments for enabling at subscription level rather than resource by resource.

Three broad categories. Potential SQL injection attacks, including the cases where an application itself produces a faulty SQL statement. Anomalous database access and query patterns, an abnormally high number of failed sign-in attempts using different credentials being the obvious example. And suspicious activity of the kind where an entirely legitimate user connects from a machine that has been talking to a crypto-mining command and control server.

With express, Defender for Cloud manages the storage for scan results itself, so no customer-managed storage account exists at all, and results are held in the same Azure region as the logical SQL server. Classic stores those results in a storage account you configure and maintain. Express is described as the recommended enablement mode, delivering identical security value.

There is. The APIs behind classic vulnerability assessment configuration retire on 16 August 2027, and the classic Advanced Threat Protection APIs retire alongside them. Migration guidance is published, and anything of yours automating configuration through either set has to be moved before that date arrives.

Three differences are documented, and for most estates all three are minor. Policy scope covers subscription and server level rather than extending to individual databases. A single rule scan result caps at 1 MB, where classic had no limit at all. And scan export produces CSV rather than Excel, though Azure Resource Graph remains available in both.

Because no baseline has been set. The assessment report can be tailored to your environment by defining an acceptable baseline across permission configurations, feature configurations and database settings. Without one, the design decisions you took deliberately keep getting reported as findings on every scan, indefinitely, until somebody stops opening the report.

It depends on the configuration model, and the difference is significant. In express configuration, applying a baseline takes effect without rescanning the database. In classic configuration it takes effect only after rescanning. That makes baseline tuning much faster on express.

Not the schedule itself. Scan scheduling is internal in both models and cannot be configured either way. The difference is that recurring scanning is permanently active under express, while classic allows you to switch it on or off. Manual scans remain available in both.

It runs on a knowledge base flagging security vulnerabilities and departures from best practice, taking in misconfigurations, permissions granted too broadly, and sensitive data left unprotected. The rules reach database-level issues and server-level ones alike, the latter including server firewall settings and server-level permissions.

Viewing results through Defender for Cloud recommendations requires Security Admin or Security Reader under either model. Changing a setting requires SQL Security Manager or security admin under express. Classic goes further and additionally demands Storage Blob Data Reader plus Owner on the storage account, which is a meaningfully wider grant to hand somebody.

Under express, in the same Azure region as the logical SQL server, with data collected and stored only while SQL vulnerability assessment is enabled. Under classic, inside whichever Azure storage account you configured, which means the location of that storage account determines your data residency position.

They do. Each alert carries details of the suspicious activity, guidance on mitigating the threat, and options for continuing the investigation through Microsoft Sentinel. For any business already running Sentinel, that keeps database alerts inside the same investigative workflow as everything else rather than in a console nobody opens.

Both are covered, SQL Server on Azure Virtual Machines and SQL Server enabled by Azure Arc alike. Those two are also the instances most frequently absent from a SQL estate inventory, because that inventory almost always begins with the Azure SQL resource list rather than with where the databases genuinely run.

It answers the database questions those processes ask: whether database configuration is assessed against a standard, whether excessive permissions are identified, whether sensitive data is protected, and whether attacks against the database would be detected. The vulnerability assessment produces the configuration evidence and Advanced Threat Protection produces the monitoring evidence. We configure the controls and the evidence; your compliance advisors own the interpretation.

Each engagement is scoped and quoted on its own terms, sized against the number of subscriptions and the scale of the SQL estate, Arc-enabled and VM-hosted instances included. Here is a first step costing nothing: find out whether your vulnerability assessment is still running on classic configuration. If it is, you have a migration with a date attached and a set of benefits available the moment you start it.

Configuration review

Fifteen questions about your own SQL estate.

Group two holds most of the value here, for the simple reason that a vulnerability assessment nobody has baselined becomes a report nobody reads.

Coverage

Is the plan enabled at subscription level?
Future resources are then covered.
Is SQL Server on VMs included?
Supported, and often forgotten.
Do we have Arc-enabled SQL Server?
Also supported.
Are Synapse dedicated pools covered?
They are in scope.
Which SQL Server versions do we run?
2012 through 2022 are protected.

Vulnerability assessment

Are we on express or classic?
Classic APIs retire in August 2027.
Do we still have a VA storage account?
Express removes the need.
Has anybody set a baseline?
Otherwise findings never clear.
Who reviews the findings?
Name them.
Do server-level findings have an owner?
Firewall and permissions.

Threat protection

Where do SQL alerts go?
A person, not a queue.
Have we ever received one?
Or tested the path.
Is Sentinel connected for investigation?
Alerts support that route.
Do we automate config with classic APIs?
They have a retirement date.
Who owns database security overall?
Often nobody.

The pages around this one.

Microsoft Defender for Cloud

The parent product and the other workload protection plans.

Defender for Servers

Protecting the machines these databases run on.

Microsoft Sentinel

The SIEM these alerts investigate through.

Next step

Find out whether your SQL vulnerability assessment is still running classic configuration.

Those classic APIs retire on 16 August 2027. Express removes the storage account, simplifies the permissions involved and applies a baseline without requiring a rescan. Every one of those benefits arrives long before the deadline does.

Book a SQL security review See Microsoft security services

Related Services

Explore more solutions that work great with this service

Retirement of the classic SQL vulnerability assessment APIs happens on 16 August 2027, and express configuration is where everybody is expected to end up.

Feature

Enabled, express, baselined

Enabled, not baselined

Not enabled

SQL injection detection

Yes

Brute force detection

Yes

Vulnerability findings produced

Yes

Findings actually triaged

Yes

Not applicable

Environment baselined

Yes

Not applicable

Storage account dependency

None

Likely still present

Not applicable

Ready for the 2027 API retirement

Yes

Not yet

Not applicable

Future databases covered

Automatically

Alerts routed to a responder

Yes

Sometimes

Not applicable

Report read next month

Yes

Not applicable

Parameter

Express configuration

Classic configuration

Storage dependency

None, Microsoft managed

A customer-managed Azure storage account

Applying a baseline

Takes effect without rescanning

Takes effect only after rescanning

Baseline settings

Batch, from latest results, or single rule

Single rule only

Recurring scan

Always active

Configurable on or off

Scan scheduling

Internal, not configurable

Policy scope

Subscription and server

Subscription, server and database

Single rule scan result size

Maximum of 1 MB

Unlimited

Scan export

CSV and Azure Resource Graph

Excel format and Azure Resource Graph

Permissions to change settings

SQL Security Manager or security admin

Plus Storage Blob Data Reader and storage account Owner

Data residency

Same region as the logical SQL server

Wherever the storage account is

Retirement of the classic SQL vulnerability assessment APIs happens on 16 August 2027, and express configuration is where everybody is expected to end up.

Eight things that determine how much value this actually returns.

Coverage across Azure SQL and SQL Server

Enablement that covers what comes next

Vulnerability assessment against a rule knowledge base

Baselines, which is where the value actually is

Threat protection for the attacks that matter

The classic API retirement date

What express configuration changes

Baseline behavior differs between the two models

On 16 August 2027 both the classic vulnerability assessment and Advanced Threat Protection APIs retire.

Four things that turn this into more than a checkbox somebody ticked.

We baseline before we report

We move to express configuration now

We include the SQL nobody counts

We make sure somebody receives the alerts

Four phases across roughly four to six weeks.

Inventory the SQL estate and enable

Move to express configuration

Baseline the findings against your environment

Route alerts and connect to investigation

Six situations where the database is the target.

A business with a customer-facing application

A regulated firm asked about database configuration

An organization with excessive database permissions

A HIPAA-covered provider running older SQL Server versions

A company still using classic configuration

A business whose database estate keeps growing

How US organizations secure their SQL estate.

Ten documented differences between the two configuration models.

Storage dependency

Applying a baseline

Baseline settings

Recurring scan

Scan scheduling

Policy scope

Single rule scan result size

Scan export

Permissions to change settings

Data residency

Five steps, and it is the baseline that decides whether any of it lasts.

Inventory the whole SQL estate

Enable at subscription level

Move to express configuration

Baseline against your actual environment

Route alerts and keep the baseline current

What US organizations ask about Defender for SQL.

What does it protect?

Do we have to add each database?

What threats does it actually detect?

What is the difference between express and classic configuration?

Is there a deadline to move?

What do we give up by moving to express?

Why do the same findings keep appearing?

How quickly does a baseline take effect?

Can we control when scans run?

What do the vulnerability rules cover?

What permissions do we need?

Where do the scan results live?

Can we investigate alerts in Sentinel?

Does it cover SQL Server on virtual machines?

Does this help with HIPAA, GLBA or a SOC 2 audit?

What does an engagement cost?

Fifteen questions about your own SQL estate.

Coverage

Vulnerability assessment

Threat protection

The pages around this one.

Microsoft Defender for Cloud

Defender for Servers

Microsoft Sentinel

Find out whether your SQL vulnerability assessment is still running classic configuration.

Related Services

Microsoft Defender for Cloud Services

Microsoft Defender for Servers

Microsoft Defender for Storage

Microsoft Defender Vulnerability Management Services

Microsoft Sentinel

Microsoft Security Services

Retirement of the classic SQL vulnerability assessment APIs happens on 16 August 2027, and express configuration is where everybody is expected to end up.