Azure SQL Encryption in transit, the minimum TLS Version doesn't allow me to specify TLS 1.3

Question

Azure SQL Encryption in transit, the minimum TLS Version doesn't allow me to specify TLS 1.3

Steve Taylor 20

I'm unable to set the minimum TLS version for data in transit for an Azure SQL DB to TLS 1.3

The option isn't available in the portal or via the PowerShell CLI

Following the instructions here: https://learn.microsoft.com/en-gb/azure/azure-sql/database/connectivity-settings?view=azuresql&tabs=azure-portal#minimal-tls-version

But TLS 1.3 just isn't there in the portal for me. I'm sure I've used this before but it has vanished.

Tried on 2 different tenants, different regions and with the preview portal.

PowerShell code tried, but get and error that: 'The argument "1.3" does not belong to the set "None,1.0,1.1,1.2" specified by the ValidateSet.'

$serverParams = @{
ServerName = "sql-server-name"     
ResourceGroupName = "sql-server-group"     
SqlAdministratorPassword = (ConvertTo-SecureString "strong_password_here_password" -AsPlainText -Force)     
MinimalTlsVersion = "1.3" 
} 

Set-AzSqlServer @serverParams

Vijayalaxmi Kattimani 3,250 Reputation points Microsoft External Staff Moderator

2025-03-27T10:50:23.71+00:00

Hi Steve Taylor,

Greetings!

In addition to the response provided by @TP, I would like to add the following information.

As we understand that, you are experiencing difficulties setting the minimum TLS version to 1.3 for your Azure SQL Database, with the option seemingly unavailable in both the Azure portal and PowerShell. This situation aligns with current Azure SQL Database capabilities.

As of now, Azure SQL Database supports TLS 1.3 when using Tabular Data Stream (TDS) version 8.0. However, the ability to enforce TLS 1.3 as the minimum required version via the 'Minimal TLS Version' setting is not yet available. The available options for this setting are 'None', '1.0', '1.1', and '1.2'. Therefore, while TLS 1.3 can be utilized, it cannot be mandated as the minimum TLS version through current configuration settings. Please refer to this link for more information https://learn.microsoft.com/en-us/sql/relational-databases/security/networking/tls-1-3?view=sql-server-ver16

This limitation is reflected in the behaviour you are observing in the Azure portal and when using PowerShell. The absence of TLS 1.3 as a selectable option and the error message indicating that "1.3" does not belong to the set of valid values ('None', '1.0', '1.1', '1.2') confirm that enforcing TLS 1.3 as the minimum version is not currently supported.

Note: Microsoft has announced the deprecation of older TLS versions (1.0 and 1.1) by August 31, 2025. Starting November 2024, setting the minimal TLS version below 1.2 will no longer be possible.

We have verified this from our end and currently observe that only TLS 1.2 is listed.

I recommend that while Azure SQL Database supports TLS 1.3 connections, enforcing it as the minimum TLS version is not currently possible. It is advisable to set the minimal TLS version to 1.2 and ensure that your applications and clients are compatible with TLS 1.2 or higher to maintain a secure connection.

Here are links to several parallel threads that may be helpful to you:

https://learn.microsoft.com/en-us/answers/questions/2180259/tls-1-0-vulnerabilites-on-sql-databases

https://learn.microsoft.com/en-us/answers/questions/1008836/tls-1-3-on-jdbc-connections-to-azure-sql-or-synaps

https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/minimal-tls-version-configure?view=azuresql

I hope this information helps. Please do let us know if you have any further queries.

Accepted answer

0 additional answers

Your answer

Answer 1

TP 124.7K Volunteer Moderator

Hi Steve,

You may run below PowerShell commands in Azure Cloud Shell:

$sql = Get-AzResource -ResourceGroupName myresourcegroup -ResourceName myazuresqlserver -ResourceType Microsoft.Sql/servers
$sql.Properties.minimalTlsVersion = "1.3"
$sql|Set-AzResource

The portal won't show 1.3 but if you check via powershell or REST API it will show 1.3

User's image

SQLSecurityAuditEvents log screenshot after connecting from TLS 1.3 client:

sql security audit event

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Vijayalaxmi Kattimani 3,250 Reputation points Microsoft External Staff Moderator

2025-03-28T08:42:49.0733333+00:00

Hi @Steve Taylor,

Following up to see, we haven’t heard from you on the last response provided by TP,

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Steve Taylor 20 Reputation points

2025-03-28T15:32:49.8666667+00:00

Many thanks this has allowed me to change the minimum version to TLS 1.3

Share via

Azure SQL Encryption in transit, the minimum TLS Version doesn't allow me to specify TLS 1.3

0 additional answers

Your answer