Service Fabric clusters should use only Azure Active Directory for client authentication
Audits whether client authentication in Service Fabric clusters uses only Azure Active Directory. The Powerpipe query flags any cluster that does not rely on Azure Active Directory for client authentication, regardless of other methods configured.
The KICS query for this control has the category Access Control and CWE 284. KICS states that Azure Active Directory must be used for authentication for Service Fabric.
What this control checks
Service Fabric clusters must have Azure Active Directory configured (tenantId set) for client.
Common pitfalls
Empty tenantId fails the policy
The policy rule matches when Microsoft.ServiceFabric/clusters/azureActiveDirectory.tenantId does not exist. It also matches when that field equals an empty string.
Policy effect defaults to Audit
The effect parameter has the defaultValue Audit. The allowed values are Audit, Deny and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Service Fabric clusters should only use Azure Active Directory for client authentication" (b54ed75b-3e1a-44ac-a333-05ba39b99ff0); PowerPipe control azure_compliance.control.servicefabric_cluster_active_directory_authentication_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_126; KICS query "Azure Active Directory Authentication" (a21c8da9-41bf-40cf-941d-330cf0d11fc7).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management), AC-2(1) (Automated System Account Management), AC-2(7) (Privileged User Accounts) and 3 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management), AC-2(1) (Automated System Account Management), AC-2(7) (Role-Based Schemes) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-2(7) Privileged User Accounts
- Access Enforcement (AC-3)
- IA-2: Identification And Authentication
1 more clause
- IA-4 Identifier Management
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-2(1) Automated System Account Management
- AC-2(7) Role-Based Schemes
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
1 more clause
- IA-4 Identifier Management
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.5.1 Identify system users, processes acting on behalf of users, and devices
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- 3.5.6 Disable identifiers after a defined period of inactivity
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-3 Access Enforcement
- IA-2 Identification and Authentication (Organizational users)
- IA-4 Identifier Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicefabric_cluster_active_directory_authentication_enabled - Checkov Check:
CKV_AZURE_126 - Powerpipe Control:
azure_compliance.control.servicefabric_cluster_active_directory_authentication_enabled - Azure Policy Definition:
b54ed75b-3e1a-44ac-a333-05ba39b99ff0 - KICS Query:
a21c8da9-41bf-40cf-941d-330cf0d11fc7
Last reviewed: 2026-10-15