Azure Compliance ControlsAzure SQL Database
SQL servers should have an Azure Active Directory administrator configured
Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services.
What this control checks
Azure Policy 1f314764-cb73-4fc9-b863-8eca98ac36e9 applies to Microsoft.Sql/servers and, with the AuditIfNotExists effect, looks for a related Microsoft.Sql/servers/administrators resource. Checkov CKV2_AZURE_7 checks that each azurerm_sql_server is connected to an azurerm_sql_active_directory_administrator. Prowler sqlserver_azuread_administrator_enabled checks that the SQL Server is configured with a Microsoft Entra (Azure AD) administrator at the server scope, indicated by administrator_type set to ActiveDirectory.
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
4 more clauses
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 8.3.4: Strong authentication for users and administrators is established and managed.
- 1 Policy on the security of network and information systems
- 6 Security in network and information systems acquisition, development and maintenance
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-2(7) Privileged User Accounts
- Access Enforcement (AC-3)
- IA-2: Identification And Authentication
1 more clause
- IA-4 Identifier Management
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-2(1) Automated System Account Management
- AC-2(7) Role-Based Schemes
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
1 more clause
- IA-4 Identifier Management
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.5.1 Identify system users, processes acting on behalf of users, and devices
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- 3.5.6 Disable identifiers after a defined period of inactivity
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 4.1.4 Ensure that Azure Active Directory Admin is Configured for SQL Servers
- 4.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers
- 5.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
- AC-2 Account Management
- AC-2(1) Automated System Account Management
- AC-2(7) Role-Based Schemes
- AC-3 Access Enforcement
- IA-2 Identification and Authentication (Organizational users)
1 more clause
- IA-4 Identifier Management
- 164.308(a)(4)(ii)(B) Access authorization
- 164.312(a)(2)(i) Unique user identification
- 164.312(d) Person or entity authentication
- 7.2.1 Confirm that access control systems are in place on all system components
- Do not store sensitive authentication data after authorization (even if encrypted)
- Incorporate multi-factor authentication for all non-console access into the CDE for personnel with administrative access
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_azure_ad_authentication_enabled - Checkov Check:
CKV2_AZURE_7 - Powerpipe Controls:
azure_compliance.control.sql_db_active_directory_admin_configured,azure_compliance.control.sql_server_azure_ad_authentication_enabled - Prowler Check:
sqlserver_azuread_administrator_enabled - Azure Policy Definition:
1f314764-cb73-4fc9-b863-8eca98ac36e9
Last reviewed: 2026-10-15