SQL servers should have a Microsoft Entra ID admin configured
Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users.
What this control checks
Azure Policy 1f314764-cb73-4fc9-b863-8eca98ac36e9 audits Microsoft.Sql/servers with AuditIfNotExists for a Microsoft.Sql/servers/administrators resource. Checkov CKV2_AZURE_7 requires each azurerm_sql_server to be connected to an azurerm_sql_active_directory_administrator. KICS a3a055d2-9a2e-4cc9-b9fb-12850a1a3a4b flags a SQL server when the Active Directory Administrator is not configured. Prowler sqlserver_azuread_administrator_enabled passes when administrator_type is set to ActiveDirectory at the server scope.
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
4 more clauses
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 8.3.4: Strong authentication for users and administrators is established and managed.
- 1 Policy on the security of network and information systems
- 6 Security in network and information systems acquisition, development and maintenance
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-2(1) Automated System Account Management
- AC-2(7) Role-Based Schemes
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
1 more clause
- IA-4 Identifier Management
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 4.4 Ensure that Azure Active Directory Admin is configured
- 4.5 Ensure that Azure Active Directory Admin is configured
- 4.1.4 Ensure that Azure Active Directory Admin is Configured for SQL Servers
- 4.1.4 Ensure that Azure Active Directory Admin is Configured for SQL Servers
- 4.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers
- 5.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
- 164.308(a)(4)(ii)(B) Access authorization
- 164.312(a)(2)(i) Unique user identification
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_db_active_directory_admin_configured - Checkov Check:
CKV2_AZURE_7 - Powerpipe Controls:
azure_compliance.control.sql_db_active_directory_admin_configured,azure_compliance.control.sql_server_azure_ad_authentication_enabled - Prowler Check:
sqlserver_azuread_administrator_enabled - Azure Policy Definition:
1f314764-cb73-4fc9-b863-8eca98ac36e9 - KICS Query:
a3a055d2-9a2e-4cc9-b9fb-12850a1a3a4b
Last reviewed: 2026-10-15