Microsoft Defender for Cloud now includes generally available CSPM assessments for Azure Database for PostgreSQL Flexible Server, giving Postgres users continuous security posture evaluations without setting up additional monitoring infrastructure.
What the assessments cover
The assessments check your PostgreSQL Flexible Server instances against a set of security baselines published by Microsoft. These cover the usual suspects: authentication configuration, network access controls, encryption settings, auditing and logging, and threat detection. The assessments run continuously, so any configuration drift gets flagged as soon as it happens rather than at the next manual review.
The CSPM (Cloud Security Posture Management) assessments are part of the broader Microsoft Defender for Cloud platform. If you already use Defender for Cloud, the PostgreSQL assessments show up alongside your existing assessments for VMs, containers, and other Azure services. The integration is seamless — no additional agents to install, no extra configuration.
What this means for Postgres users
If you run PostgreSQL on Azure, you probably already have some security monitoring in place. The question is whether it covers the database layer specifically. Most monitoring tools cover infrastructure and applications but leave the database as a blind spot. These assessments close that gap.
The assessments surface specific, actionable recommendations. You are not told “your database is insecure” without context. You get things like “enable TLS 1.2 or higher” or “restrict public network access to approved IP ranges” or “enable audit logging for failed connections.” Each recommendation includes the remediation steps and links to the relevant documentation.
One of the more useful checks is the authentication assessment. It flags instances using password authentication instead of Microsoft Entra ID (formerly Azure AD). For production databases, Entra ID authentication is the stronger option because it avoids connection strings with embedded passwords and supports managed identities and conditional access policies.
Practical considerations
The assessments are part of Defender for Cloud, which is a paid service. The cost depends on the plan tier you choose and the number of resources being assessed. For a small number of PostgreSQL instances, the cost is modest. For large fleets, you should estimate the cost before enabling assessments across all instances.
There is also the question of what to do with the findings. Getting a list of security recommendations is only useful if you have the capacity to act on them. The assessments tend to surface the same types of issues across environments: overly permissive network rules, missing encryption, and disabled audit logging. A good strategy is to fix the critical findings first, then work through the medium and low severity items over time.
What to check first
If you enable the assessments today, here is what to look for in the first scan:
Network access controls. Check how many of your instances have public access enabled. For production instances, the recommendation is to disable public access and use private endpoints or VNet service endpoints. Development instances are more forgiving, but use IP-based firewall rules rather than wide open access.
Audit logging. Many PostgreSQL instances have audit logging disabled by default. The assessments flag this and recommend enabling pgAudil or the built-in log analytics integration. This is not just a compliance checkbox — audit logs are how you detect and investigate suspicious activity.
Encryption in transit. The assessments check whether TLS is enforced for client connections. If your applications use SSL mode “require” or “verify-full,” you are in good shape. If they use “disable” or “prefer,” you have a gap.
Comparing with other database security tools
If you are already using a third-party CSPM tool like Wiz or Prisma Cloud, the Microsoft Defender assessments overlap with what those tools provide for the database layer. The advantage of the Defender assessments is that they are native to Azure, so they pick up Azure-specific configuration issues that generic CSPM tools might miss. Things like Azure Private Link configuration, managed identity settings, and diagnostic logging integration are all checked natively.
The disadvantage is that the Defender assessments are Azure-only. If you run a multi-cloud database fleet, you need a separate tool for the other clouds. Native Azure assessments also do not cover the PostgreSQL instance itself beyond what Azure exposes through its management plane — they check the Azure resource configuration, not the database internals like query patterns or user permissions.
For most teams, the right strategy is to use Defender for Cloud as the primary assessment tool for Azure PostgreSQL instances and supplement it with PostgreSQL-specific security tools for the database internals. The assessments cover the top layer of the security stack. The database itself needs its own monitoring.
Setting up the assessments
Enabling the assessments is straightforward. Navigate to Microsoft Defender for Cloud in the Azure portal, go to the Environment Settings for your subscription, and enable the PostgreSQL Flexible Server recommendations. The assessments start running automatically. You can also enable them at scale using Azure Policy across multiple subscriptions.
Once enabled, the findings appear in the Defender for Cloud dashboard alongside your other security recommendations. The PostgreSQL-specific findings are grouped under the “Databases” category. You can filter by severity, resource type, and compliance framework to focus on the most relevant recommendations.