For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-ies.md. A documentation index is available at /llms.txt.

Microsoft Entra admin should be configured for Azure SQL

azure.sql

Description

By default, Microsoft Entra authentication for SQL Database/Server is not enabled. However, utilizing Microsoft Entra authentication allows for managing credentials in a centralized location. This authentication mechanism enables connecting to Microsoft Azure SQL Database and SQL Data Warehouse using Microsoft Entra identities. By using Microsoft Entra authentication, database users and other Microsoft services can be managed in a single central location, simplifying permission management and providing an alternative to SQL Server authentication. It also eliminates the need to store passwords by enabling integrated Windows authentication and supports various forms of authentication, including token-based authentication for applications and multi-factor authentication (MFA). To properly implement Microsoft Entra ID for central authentication, it is important to configure the necessary groups and roles based on the organization’s requirements.

Remediation

From the console

  1. Go to SQL servers.
  2. For each SQL server, click Microsoft Entra ID under Settings.
  3. Click Set admin.
  4. Select an admin and click Save.
  5. Select the Support only Microsoft Entra authentication for this server checkbox.
  6. The Enable Microsoft Entra-only authentication popup appears. Click Yes to enable the feature and Save the setting.