Service Fabric clusters should use only Azure Active Directory for client authentication
Audit usage of client authentication only via Azure Active Directory in Service Fabric.
What this control checks
Azure Policy b54ed75b-3e1a-44ac-a333-05ba39b99ff0 applies its effect to Microsoft.ServiceFabric/clusters when azureActiveDirectory.tenantId does not exist or equals an empty string. Checkov CKV_AZURE_126 inspects azurerm_service_fabric_cluster and the key azure_active_directory/[0]/tenant_id, expecting any value. KICS a21c8da9-41bf-40cf-941d-330cf0d11fc7 flags an azurerm_service_fabric_cluster with no azure_active_directory block, or one without tenant_id. Powerpipe servicefabric_cluster_active_directory_authentication_enabled returns ok when azure_active_directory is not null, otherwise alarm.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-2(7) Privileged User Accounts
- Access Enforcement (AC-3)
- IA-2: Identification And Authentication
1 more clause
- IA-4 Identifier Management
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-2(1) Automated System Account Management
- AC-2(7) Role-Based Schemes
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
1 more clause
- IA-4 Identifier Management
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.5.1 Identify system users, processes acting on behalf of users, and devices
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- 3.5.6 Disable identifiers after a defined period of inactivity
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-3 Access Enforcement
- IA-2 Identification and Authentication (Organizational users)
- IA-4 Identifier Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicefabric_cluster_active_directory_authentication_enabled - Checkov Check:
CKV_AZURE_126 - Powerpipe Control:
azure_compliance.control.servicefabric_cluster_active_directory_authentication_enabled - Azure Policy Definition:
b54ed75b-3e1a-44ac-a333-05ba39b99ff0 - KICS Query:
a21c8da9-41bf-40cf-941d-330cf0d11fc7
Last reviewed: 2026-10-15