V-255344

Discussion

Auditing for Azure SQL Database tracks database events and writes them to an audit log in the Azure storage account, Log Analytics workspace, or Event Hubs. Under normal conditions, the audit space allocated by an Azure Storage account can grow quite large. Since a requirement exists to halt processing upon audit failure, a service outage would result.

Check Content

Azure SQL Database must provide notice upon audit storage reaching capacity.

Verify if an Azure Rule exists with the following command example:

$storageAcct = Get-AzStorageAccount -ResourceGroupName "Name of RG for Audit Storage" -Name "Audit Storage Account Name"
$metric = Get-AzMetricAlertRuleV2 | Where-Object TargetResourceId -eq $storageAcct.Id
$metric.Criteria

If no alert exists, this is a finding.

If the criteria does not match 75 percent or less than the maximum capacity of 5 TiB, this is a finding.