SQL servers should have an Azure Active Directory administrator configured
Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services.
Without a Microsoft Entra admin, the server can't use Entra identities, pushing reliance on SQL authentication. This weakens confidentiality and integrity: no MFA/conditional access, harder offboarding and auditing, and compromised passwords can enable unauthorized data access and privilege escalation.
What this control checks
SQL servers must have an Azure Active Directory administrator configured
Common pitfalls
Entra admin must be at server scope
Azure SQL Server is configured with a Microsoft Entra (Azure AD) administrator at the server scope, indicated by administrator_type set to ActiveDirectory.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "An Azure Active Directory administrator should be provisioned for SQL servers" (1f314764-cb73-4fc9-b863-8eca98ac36e9); Prowler check sqlserver_azuread_administrator_enabled (prowler azure --checks sqlserver_azuread_administrator_enabled); PowerPipe controls azure_compliance.control.sql_db_active_directory_admin_configured and azure_compliance.control.sql_server_azure_ad_authentication_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_7.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 7.2.1 (Access to system components and data is appropriately defined and assigned.), 7.2.2 (Access to system components and data is appropriately defined and assigned.), 7.2.5 (Access to system components and data is appropriately defined and assigned.) and 6 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 1.2.4 (Depending on the size of the relevant entities, network and information system security shall be covered by dedicated...) and 6.7.2.e (not use systems used for administration of the security policy implementation for other purposes;).
NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management), AC-2(1) (Automated System Account Management), AC-2(7) (Privileged User Accounts) and 3 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management), AC-2(1) (Automated System Account Management), AC-2(7) (Role-Based Schemes) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
4 more clauses
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 8.3.4: Strong authentication for users and administrators is established and managed.
- 1 Policy on the security of network and information systems
- 6 Security in network and information systems acquisition, development and maintenance
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-2(7) Privileged User Accounts
- Access Enforcement (AC-3)
- IA-2: Identification And Authentication
1 more clause
- IA-4 Identifier Management
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-2(1) Automated System Account Management
- AC-2(7) Role-Based Schemes
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
1 more clause
- IA-4 Identifier Management
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.5.1 Identify system users, processes acting on behalf of users, and devices
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- 3.5.6 Disable identifiers after a defined period of inactivity
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 4.1.4 Ensure that Azure Active Directory Admin is Configured for SQL Servers
- 4.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers
- 5.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-2(7) Role-Based Schemes
- AC-3 Access Enforcement
- IA-2 Identification and Authentication (Organizational users)
1 more clause
- IA-4 Identifier Management
- 164.308(a)(4)(ii)(B) Access authorization
- 164.312(a)(2)(i) Unique user identification
- 164.312(d) Person or entity authentication
- 7.2.1 Confirm that access control systems are in place on all system components
- Do not store sensitive authentication data after authorization (even if encrypted)
- Incorporate multi-factor authentication for all non-console access into the CDE for personnel with administrative access
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_azure_ad_authentication_enabled - Checkov Check:
CKV2_AZURE_7 - Powerpipe Controls:
azure_compliance.control.sql_db_active_directory_admin_configured,azure_compliance.control.sql_server_azure_ad_authentication_enabled - Prowler Check:
sqlserver_azuread_administrator_enabled - Azure Policy Definition:
1f314764-cb73-4fc9-b863-8eca98ac36e9
Last reviewed: 2026-10-15