Does the current SQL Database TLS Policy check if nothing is selected?

Pooja Goel 0

We recently implemented a built-in Azure Policy, that checks for the minimum TLS Version to be 1.2. - https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F32e6bbec-16b6-44c2-be37-c5b672d103cf

When running the policy against our resources, the report returns compliant, whereas on the resource itself, the MinimalTLSVersion is 'None'.

User's image

Do we need to tweak the policy to check if nothing is defined?

tbgangav-MSFT 10,416 Reputation points

2024-06-04T18:50:52.8366667+00:00

Hi @Pooja Goel ,

Yes, I believe you are correct.

I have tested the policy as is by setting one resource with tls less than 1.2 and another resource with tls as none. On doing the compliance scan, I see that resource with tls less than 1.2 is shown as non-compliant whereas another resource with tls as none is shown as compliant! Let me try to tweak the policy to check if nothing is defined and get back with insights after I test it out successfully.

For illustration, check below screenshots.

Compliance details for resource with tls less than 1.2:

Compliance details for resource with tls as none:

Your answer