SQL servers should have an Active Directory administrator configured to enforce centralized identity, stronger authentication, and auditable access controls. Relying solely on SQL authentication increases the attack surface and makes access management and auditing more difficult. For Ansible, tasks using the azure.azcollection.azure_rm_sqlserver or azure_rm_sqlserver module must define the ad_user property and set it to a valid Azure AD principal (for example, a user UPN or objectId). Resources missing ad_user or with it empty or undefined are flagged.
Secure example:
- name: Create Azure SQL Server with AD admin
azure.azcollection.azure_rm_sqlserver:
name: my-sql-server
resource_group: my-rg
location: eastus
ad_user: "adminuser@contoso.com"
admin_password: "secure-password"
