Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article describes the Policy guardrails in place to ensure Azure SQL is deployed securely.
SQL GitHub Repository
SQL Policies Built in
| Name | Description | Version | Type | Effect | Policy definition |
|---|---|---|---|---|---|
| Azure SQL Database should be running TLS version 1.2 or newer | Setting TLS version to 1.2 or newer improves security by ensuring your Azure SQL Database can only be accessed from clients using TLS 1.2 or newer. Using versions of TLS less than 1.2 isn't recommended since they have well documented security vulnerabilities. | 2.0.0 | Built-in Policies | AuditDeny | Link |
| Azure SQL Managed Instances should disable public network access | Disabling public network access (public endpoint) on Azure SQL Managed Instances improves security by ensuring that they can only be accessed from inside their virtual networks or via Private Endpoints. To learn more about public network access, visit https://aka.ms/mi-public-endpoint. |
1.0.0 | Built-in Policies | AuditDeny | Link |
| Public network access on Azure SQL Database should be disabled | Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules. | 1.1.0 | Built-in Policies | AuditDeny | Link |
| Private endpoint connections on Azure SQL Database should be enabled | Private endpoint connections enforce secure communication by enabling private connectivity to Azure SQL Database. | 1.1.0 | Built-in Policies | Audit | Link |
| Azure SQL Database should be running TLS version 1.2 or newer | Setting TLS version to 1.2 or newer improves security by ensuring your Azure SQL Database can only be accessed from clients using TLS 1.2 or newer. Using versions of TLS less than 1.2 isn't recommended since they have well documented security vulnerabilities. | 2.0.0 | Built-in Policies | AuditDeny | Link |
| Deploy SQL DB transparent data encryption | Enables transparent data encryption on SQL databases | 2.2.0 | Built-in Policies | Deploy | Link |
| A Microsoft Entra ID administrator should be created for SQL servers | Audit creation of a Microsoft Entra ID administrator for your SQL server to enable Microsoft Entra ID authentication. Microsoft Entra ID authentication enables simplified permission management and centralized identity management of database users and other Microsoft services | 1.0.0 | Built-in Policies | AuditIfNotExist | Link |
| Azure SQL Database should have Microsoft Entra-only authentication enabled | Disabling local authentication methods and allowing only Microsoft Entra authentication improves security by ensuring that Azure SQL Databases can exclusively be accessed by Microsoft Entra identities. Learn more at: aka.ms/adonlycreate. | 1.1.0 | Built-in Policies | AuditDeny | Link |
| Auditing on SQL server should be enabled | Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log. | 2.0.0 | Built-in Policies | AuditIfNotExist | Link |
| Azure Defender for SQL should be enabled for unprotected Azure SQL servers | Audit SQL servers without Advanced Data Security | 2.0.1 | Built-in Policies | AuditIfNotExist | Link |
| Azure Defender for SQL should be enabled for unprotected SQL Managed Instances | Audit each SQL Managed Instance without advanced data security. | 1.0.2 | Built-in Policies | AuditIfNotExist | Link |
| Configure Azure Defender to be enabled on SQL managed instances | Enable Azure Defender on your Azure SQL Managed Instances to detect anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. | 2.0.0 | Built-in Policies | Deploy | Link |
| Configure Azure Defender to be enabled on SQL servers | Enable Azure Defender on your Azure SQL Servers to detect anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. | 2.1.0 | Built-in Policies | DeployIfNotExists | Link |
| SQL databases should have vulnerability findings resolved | Monitor vulnerability assessment scan results and recommendations for how to remediate database vulnerabilities. | 4.1.0 | Built-in Policies | AuditIfNotExist | Link |
| Vulnerability assessment should be enabled on your SQL servers | Audit Azure SQL servers which do not have vulnerability assessment properly configured. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities. | 3.0.0 | Built-in Policies | AuditIfNotExist | Link |
SQL Policies Custom
| Name | Description | Version | Type | Effect | Policy definition |
|---|---|---|---|---|---|
| SQL managed instances should use customer-managed keys to encrypt data at rest | Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. | 2.0.0 | Custom | AuditDeny | N/A |
| SQL servers should use customer-managed keys to encrypt data at rest | Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. | 2.0.1 | Custom | AuditDeny | N/A |
| SQL Managed Instance should have the minimal TLS version of 1.2 | Setting minimal TLS version to 1.2 improves security by ensuring your SQL Managed Instance can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 isn't recommended since they have well documented security vulnerabilities. | 1.0.1 | Custom | Audit | N/A |
| Transparent Data Encryption on SQL databases should be enabled | Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements | 1.0.0 | Custom | AuditIfNotExist | N/A |
| Configure Azure SQL Server to disable public network access | Disabling the public network access property shuts down public connectivity such that Azure SQL Server can only be accessed from a private endpoint. This configuration disables the public network access for all databases under the Azure SQL Server. | 1.0.0 | Custom | Modify | N/A |
| SQL Server should use a virtual network service endpoint | This policy audits any SQL Server not configured to use a virtual network service endpoint. | 1.0.0 | Custom | AuditIfNotExist | N/A |
| Azure SQL Managed Instance should have Microsoft Entra ID Only Authentication enabled | Disabling local authentication methods and allowing only Microsoft Entra ID Authentication improves security by ensuring that Azure SQL Managed Instances can exclusively be accessed by Microsoft Entra ID identities. Learn more at: aka.ms/adonlycreate. | 1.0.0 | Custom | AuditDeny | N/A |
| SQL servers with auditing to storage account destination should be configured with 90 days retention or higher | For incident investigation purposes, we recommend setting the data retention for your SQL Server' auditing to storage account destination to at least 90 days. Confirm that you're meeting the necessary retention rules for the regions in which you're operating. This is sometimes required for compliance with regulatory standards. | 3.0.0 | Custom | AuditIfNotExist | N/A |
| Vulnerability assessment should be enabled on SQL Managed Instance | Audit each SQL Managed Instance which doesn't have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities. | 1.0.1 | Custom | AuditIfNotExist | N/A |