Microsoft Defender for Cloud has shipped generally available CSPM (Cloud Security Posture Management) assessments for Azure Database for PostgreSQL Flexible Server, giving teams automated security evaluations that run continuously against their PostgreSQL deployments.
The assessments are part of Microsoft Defender for Cloud’s CSPM framework, which evaluates Azure resources against security baselines and best practices. The PostgreSQL-specific assessments cover network security, auditing controls, and operational resilience — the three areas where misconfiguration is most likely to cause a breach.
What the assessments check
The initial set of CSPM assessments for PostgreSQL Flexible Server focuses on the configurations that matter most in practice. On the network side, the assessments check whether the server has public network access enabled, whether firewall rules are overly permissive, and whether private endpoint connections are configured for production workloads. Having a PostgreSQL server with a 0.0.0.0/0 firewall rule is still one of the most common findings in Azure security reviews, and the CSPM assessment flags it automatically.
For auditing, the assessments verify that server parameter logging configurations are enabled — specifically, that log_checkpoints, log_connections, and log_disconnections are turned on, and that the log_retention_days setting meets the minimum threshold. These settings are the difference between being able to investigate a security incident and having no record of what happened.
On the operational side, the assessments check for backup configuration, geo-redundant storage, and whether the server is configured for high availability. A PostgreSQL server without automated backups or with locally redundant storage in a single region is a recovery risk that the assessment flags against the baseline.
How to use the assessments
The assessments are available in the Microsoft Defender for Cloud portal under the Recommendations blade. Each assessment returns a compliance status: Healthy, Unhealthy, or Not Applicable. For unhealthy resources, the recommendation includes the remediation steps and a link to the affected resource for direct configuration changes.
The assessments run on a schedule that Defender for Cloud manages. You do not need to install an agent or configure anything on the PostgreSQL server itself. The assessments are evaluated against the Azure Resource Manager configuration and the server’s parameter settings, which Defender for Cloud reads through the Azure control plane. If you have Defender for Cloud’s CSPM plan enabled — which is the default for new subscriptions — the PostgreSQL assessments are active immediately.
For teams that use Azure Policy, the assessments are also available as built-in policy definitions. You can assign them at the subscription or management group level and track compliance through the Policy compliance dashboard. This is useful for organizations that need to demonstrate compliance against their own security baselines or regulatory frameworks.
What changed with GA
The CSPM assessments for PostgreSQL Flexible Server were available in preview for several months before this GA release. The GA designation means the assessments have a stable API surface, a published SLA for the evaluation schedule, and Microsoft support coverage. The assessment logic and baseline rules are locked in for the GA version, though Microsoft will add new assessments over time as the PostgreSQL service evolves.
The GA release also removes the preview limitations. In preview, the assessments were read-only recommendations. In GA, they integrate with the full Defender for Cloud workflow, including automated remediation through Azure Policy, integration with SIEM systems through continuous export, and the Defender for Cloud secure score calculation.
Practical considerations
The assessments are useful, but they are not a replacement for a proper database security review. They check configuration settings that Defender for Cloud can read through the Azure control plane, which means they cover infrastructure-level security but not application-level security. Things like SQL injection vulnerabilities, weak authentication mechanisms in application code, or overly permissive database roles are not in scope.
What the assessments do well is catch the configuration drift that happens when teams manage PostgreSQL servers outside of infrastructure-as-code pipelines. A server that was provisioned with private endpoint access can end up with a public IP added during a troubleshooting session, and the CSPM assessment catches it on the next evaluation cycle. The continuous nature of the assessments is the real value — they catch things that manual reviews miss because they happen between review cycles.
For teams running multiple PostgreSQL Flexible Servers across subscriptions, the CSPM assessments give a single view of the security posture across the entire fleet. The secure score integration means you can track whether your PostgreSQL security posture is improving or degrading over time, which is useful for reporting to management or auditors.
Getting started
If you already have Defender for Cloud enabled with the CSPM plan, the PostgreSQL assessments are running. Open the Recommendations blade, search for “PostgreSQL” and review the results. If you have not enabled Defender for Cloud, you can enable it at the subscription level from the Azure portal. The CSPM plan is included at no additional cost for all Azure subscriptions.
For existing PostgreSQL Flexible Server deployments, the initial assessment results may show several unhealthy findings. Most of these are straightforward to remediate — enable logging parameters, tighten firewall rules, configure backups — and the assessment provides the specific configuration values that meet the baseline. The remediation steps are documented in the Microsoft Learn article on Defender for Cloud for PostgreSQL.