Secure your Azure Database for MySQL

Azure Database for MySQL is a fully managed relational database service that provides high availability, automated backups, and scalable MySQL-compatible database hosting. Securing your flexible server deployments helps protect sensitive data, reduce identity and network exposure, and support compliance requirements.

This article provides security recommendations to help protect your Azure Database for MySQL deployment.

The security recommendations in this article implement Zero Trust principles: "Verify explicitly", "Use least privilege access", and "Assume breach". For comprehensive Zero Trust guidance, see the Zero Trust Guidance Center.

Network security

Network security controls help restrict how clients reach Azure Database for MySQL flexible server instances and reduce exposure to public internet traffic.

Identity and access management

Identity and access controls help centralize authentication, reduce credential exposure, and enforce least privilege for both Azure management operations and database access.

  • Use Microsoft Entra authentication for database access: Configure Microsoft Entra authentication for Azure Database for MySQL flexible server so users and applications can authenticate with Microsoft Entra identities instead of relying only on MySQL passwords. For more information, see Microsoft Entra authentication for Azure Database for MySQL - Flexible Server.
  • Use Microsoft Entra-only authentication when possible: Disable MySQL native authentication after you migrate users and applications to Microsoft Entra authentication to reduce password-based access paths to the flexible server. For more information, see Microsoft Entra authentication for Azure Database for MySQL - Flexible Server.
  • Use managed identities for application connections: Use managed identities or service principals with Microsoft Entra authentication so applications connect to Azure Database for MySQL with tokens instead of embedded database passwords. For more information, see Microsoft Entra authentication for Azure Database for MySQL - Flexible Server.
  • Assign least-privilege database permissions: Create dedicated MySQL users or Microsoft Entra-mapped database users for each application or administrative function, and grant only the schema, table, and operation permissions each identity needs. For more information, see Create users in Azure Database for MySQL.
  • Enforce Conditional Access for Azure Database for MySQL administrators: Apply Conditional Access policies that require multifactor authentication for identities that can manage flexible server resources through Azure Resource Manager tools such as the Azure portal, Azure CLI, and Azure PowerShell. For more information, see Require MFA for Azure management.

Data protection

Azure Database for MySQL encrypts data at rest with service-managed keys by default. The following controls give you more control over encryption, key management, and encrypted client connections.

  • Require encrypted client connections: Keep require_secure_transport enabled so client connections to Azure Database for MySQL use TLS encryption and don't send database traffic in clear text. For more information, see Transport Layer Security (TLS) in Azure Database for MySQL.
  • Enforce TLS 1.3 for MySQL 8.0 servers: Set tls_version to TLS 1.3 on Azure Database for MySQL 8.0 flexible servers after you confirm that client applications and drivers support TLS 1.3. For more information, see Transport Layer Security (TLS) in Azure Database for MySQL.
  • Validate server certificates from clients: Configure client applications to validate the server certificate chain and trust only root certificate authorities so routine intermediate CA or server certificate rotations don't break secure connections. For more information, see Transport Layer Security (TLS) in Azure Database for MySQL.
  • Use customer-managed keys for key control: Use customer-managed keys stored in Azure Key Vault or Azure Key Vault Managed HSM when you need separation of duties, customer-controlled key lifecycle management, or more compliance controls for data-at-rest encryption. For more information, see Data encryption with customer managed keys for Azure Database for MySQL.
  • Protect customer-managed key dependencies: Enable soft delete and purge protection on the Key Vault or Managed HSM that stores the customer-managed key, assign the required key permissions to the server's user-assigned managed identity, and monitor key access because loss of key access can make the flexible server inaccessible. For more information, see Data encryption with customer managed keys for Azure Database for MySQL.

Logging and monitoring

Logging and monitoring controls help you detect suspicious database activity, investigate administrative changes, and preserve audit evidence for compliance.

Compliance and governance

Compliance and governance controls help you enforce consistent secure configuration across Azure Database for MySQL flexible server fleets and protect production resources from accidental or unauthorized changes.

  • Enforce diagnostic logging with Azure Policy: Assign built-in Azure Policy definitions for microsoft.dbformysql/flexibleservers diagnostic settings, such as policies that route logs to Log Analytics, Event Hubs, or Storage, so flexible server audit data is collected consistently. For more information, see Azure Policy built-in policy definitions.
  • Apply deletion locks to production servers: Add a CanNotDelete lock to production Azure Database for MySQL flexible server resources to reduce the risk of accidental deletion while preserving normal operational changes. For more information, see Lock your Azure resources to protect your infrastructure.
  • Tag database resources for governance: Apply tags such as workload, environment, data classification, owner, and cost center to Azure Database for MySQL flexible server resources so policy assignments, inventory queries, and cost reviews can distinguish production and sensitive database workloads. For more information, see Use tags to organize your Azure resources and management hierarchy.

Backup and recovery

Backup and recovery controls help you recover from accidental deletion, data corruption, regional outages, and risky change operations.

Next steps

  • Last updated on