Store Vulnerability Assessment scan results in a storage account accessible behind firewalls and VNets
If you are limiting access to your storage account in Azure for certain VNets or services, you'll need to enable the appropriate configuration so that Vulnerability Assessment (VA) scanning for SQL Databases or Managed Instances have access to that storage account.
Enable Azure SQL Database VA scanning access to the storage account
If you have configured your VA storage account to only be accessible by certain networks or services, you'll need to ensure that VA scans for your Azure SQL Database are able to store the scans on the storage account. To find out which storage account is being used, go to your SQL server pane in the Azure portal, under Security, select Security center.
You can use the existing storage account, or create a new storage account to store VA scan results for all databases on your logical SQL server.
Go to your Resource group that contains the storage account and access the Storage account pane. Under Settings, select Firewall and virtual networks.
Ensure that Allow trusted Microsoft services access to this storage account is checked.
Store VA scan results for Azure SQL Managed Instance in a storage account that can be accessed behind a firewall or VNet
Since Managed Instance is not a trusted Microsoft Service and has a different VNet from the storage account, executing a VA scan will result in an error.
To support VA scans on Managed Instances, follow the below steps:
In the SQL managed instance pane, under the Overview heading, click the Virtual network/subnet link. This takes you to the Virtual network pane.
Under Settings, select Subnets. Click Subnet in the new pane to add a subnet, and delegate it to Microsoft.sql\managedInstance. For more information, see Manage subnets.
In your Virtual network pane, under Settings, select Service endpoints. Click Add in the new pane, and add the Microsoft.Storage Service as a new service endpoint. Make sure the ManagedInstance Subnet is selected. Click Add.
Go to your Storage account that you've selected to store your VA scans. Under Settings, select Firewall and virtual networks. Click on Add existing virtual network. Select your managed instance virtual network and subnet, and click Add.
You should now be able to store your VA scans for Managed Instances in your storage account.