SQL servers should have minimum TLS version set to 1.2 or higher
Azure SQL logical servers are assessed for the configured minimum TLS version for client connections. The finding determines whether the minimal accepted version aligns with recommended modern values such as `1.2` or `1.3`.
Setting TLS version to 1.2 or newer improves security by ensuring your Azure SQL Database can only be accessed from clients using TLS 1.2 or newer. Using versions of TLS less than 1.2 is not recommended since they have well documented security vulnerabilities. Without a modern minimum, clients can negotiate weak TLS or be downgraded, enabling MITM and decryption.
What this control checks
SQL servers must set the minimum TLS version to 1.2 or higher
Common pitfalls
Missing minimalTlsVersion is flagged
The policy flags Microsoft.Sql/servers where Microsoft.Sql/servers/minimalTlsVersion does not exist. It also flags servers where the value is less than 1.2.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure SQL Database should be running TLS version 1.2 or newer" (32e6bbec-16b6-44c2-be37-c5b672d103cf); Prowler check sqlserver_recommended_minimal_tls_version (prowler azure --checks sqlserver_recommended_minimal_tls_version).
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_52; KICS query "Beta - MSSQL Not Using Latest TLS Encryption Version" (22cb3507-1ef4-44ac-9c9a-cab31167e31e); Trivy check AZU-0026.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 6.7.2.i (establish communication between distinct systems only through trusted channels that are isolated using logical...) and 6.7.2.l (apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 6 Security in network and information systems acquisition, development and maintenance
- 12 Asset management
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
- OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
2 more clauses
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_sqlserver_recommended_minimal_tls_version - Checkov Check:
CKV_AZURE_52 - Prowler Check:
sqlserver_recommended_minimal_tls_version - Azure Policy Definition:
32e6bbec-16b6-44c2-be37-c5b672d103cf - KICS Query:
22cb3507-1ef4-44ac-9c9a-cab31167e31e - Trivy Check:
AZU-0026
Last reviewed: 2026-10-11