Remediation scripts/Vulnerability assessment should be enabled on your SQL servers/PowerShell/Enable-AzSecuritySQLVA.ps1 (36 lines of code) (raw):
Write-Verbose "Checking for Azure module..."
$AzModule = Get-Module -Name "Az.*" -ListAvailable
if ($AzModule -eq $null) {
Write-Verbose "Azure PowerShell module not found"
#check for Admin Privleges
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if(-not ($currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))){
#No Admin, install to current user
Write-Warning -Message "Can not install Az Module. You are not running as Administrator"
Write-Warning -Message "Installing Az Module to Current User Scope"
Install-Module Az -Scope CurrentUser -Force
Install-Module Az.Security -Scope CurrentUser -Force
}
Else{
#Admin, install to all users
Install-Module Az -Force
Install-Module Az.Security -Force
}
}
#Login to Azure
Login-AzAccount
#Get All Subs
$Subscriptions = Get-AzSubscription
#Loop Through Subs
foreach($Subscription in $Subscriptions){
$Id = ($Subscription.Id)
Select-AzSubscription $Id
#Get Security Task for SQL VA
$SecurityTasks += Get-AzSecurityTask | Where-Object {$_.RecommendationType -eq "Vulnerability assessment should be enabled on your SQL managed instances"}
}
#Loop Thru tasks
foreach($SecurityTask in $SecurityTasks){
$SecurityTask.ResourceId
$StorageAccount = Read-Host "Please enter the stroage account name to configure for SQL MI VA"
Update-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName ($SecurityTask.ResourceId.Split("/")[4]) -ServerName ($SecurityTask.ResourceId.Split("/")[8]) -StorageAccountName $StorageAccount
}