Service Bus namespaces should have Azure Active Directory (Azure AD) authentication configured
This policy identifies Azure Service bus namespaces that are not configured with `Azure Active Directory (Azure AD)` authentication. It is recommended to configure the Service bus namespaces with `Azure AD` authentication.
Azure AD provides superior security and ease of use over shared access signatures (SAS). With Azure AD, there's no need to store the tokens in your code and risk potential security vulnerabilities.
What this control checks
Service Bus namespaces must have local authentication disabled so Azure AD is used.
Common pitfalls
Modify only applies to newer API versions
The addOrReplace operation on Microsoft.ServiceBus/namespaces/disableLocalAuth has the condition greaterOrEquals(requestContext().apiVersion, '2021-06-01-preview').
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure Azure Service Bus namespaces to disable local authentication" (910711a6-8aa2-4f15-ae62-1e5b2ed3ef9e) and "Azure Service Bus namespaces should have local authentication methods disabled" (cfb11c26-f069-4c14-8e36-56c394dae5af); PowerPipe control azure_compliance.control.servicebus_namespace_azure_ad_authentication_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_203.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicebus_namespace_azure_ad_authentication_enabled - Checkov Check:
CKV_AZURE_203 - Powerpipe Control:
azure_compliance.control.servicebus_namespace_azure_ad_authentication_enabled - Azure Policy Definitions:
910711a6-8aa2-4f15-ae62-1e5b2ed3ef9e,cfb11c26-f069-4c14-8e36-56c394dae5af
Last reviewed: 2026-10-15