SQL Server should use Azure AD-only authentication

High Azure General sql-sql-server-azure-ad-only

Applies to

Microsoft.Sql/servers

What CGPulse checks

A resource passes this rule when administrators.azureAdOnlyAuthentication must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable Azure AD-only authentication to eliminate brute-forceable SQL passwords. In Azure Portal: SQL Server > Azure Active Directory > enable Azure AD-only authentication. See: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-only-auth-tutorial

Careful: Disabling SQL authentication breaks ALL apps using login/password connection strings. Ensure all apps use Azure AD (Managed Identity or token) before enabling

CLI

az sql server ad-only-auth enable --ids "{id}"

Terraform

resource "azurerm_mssql_server" "{name}" {
  name                         = "{name}"
  resource_group_name          = "{rg}"
  location                     = var.location
  version                      = "12.0"
  azuread_administrator {
    azuread_authentication_only = true
    login_username              = "sqladmin"
    object_id                   = "<entra-group-object-id>"
  }
}

Compliance frameworks

Cloud Security BaselineIM-1
Cloud Security: Azure Foundations
Critical Security Controls v85.1
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.308(a)(4)
ISO 27001: Information SecurityA.9.2.1
NIST 800-53: Cloud Security ControlsIA-2
PCI DSS v4.08.3.1
SOC 2: Trust ServicesCC6.1

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan