Azure Compliance ControlsAzure Database for PostgreSQL
PostgreSQL flexible servers should have Microsoft Entra ID authentication enabled
PostgreSQL Flexible Servers must set `authConfig.activeDirectoryAuth` to `Enabled`. They must also keep at least one Microsoft Entra administrator assigned so database sessions inherit centrally governed identities instead of unmanaged PostgreSQL accounts.
What this control checks
PostgreSQL flexible servers must have Microsoft Entra ID authentication enabled.
Framework mappings
The clauses this control is mapped to in each framework.
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- 164.312(a)(2)(i) Unique user identification
- 164.312(d) Person or entity authentication
Related controls
- PostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'
- PostgreSQL flexible servers should have log_disconnections enabled
- Network security groups should limit inbound TCP port 5432 access from the internet
- Microsoft Entra ID tenants should have a multifactor authentication policy configured for all users
- Cognitive Search services should use managed identity
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_postgresql_flexible_server_entra_id_authentication_enabled - Prowler Check:
postgresql_flexible_server_entra_id_authentication_enabled
Last reviewed: 2026-10-11