Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
mysql_flexible_server_audit_log_enabledProvider: Azure
Service:
mysqlSeverity: MEDIUM
Categories:
loggingResource type:
microsoft.dbformysql/flexibleserversWhat this check verifies
Azure Database for MySQL Flexible Server withaudit_log_enabled set to ON generates audit logs for connections, authentication, DDL/DML, and administrative actions.
Risk
Missing audit logs reduces accountability and obscures activity affecting confidentiality and integrity. Unauthorized logins, privilege abuse, or suspicious queries may go undetected, impeding forensics, slowing incident response, and enabling covert data exfiltration.Recommendation
Enable audit logging (audit_log_enabled=ON) and select events that matter. Export MySqlAuditLogs to a centralized store, enforce least privilege on log access, set retention, and create alerts for anomalies. Regularly review logs as part of defense in depth.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az mysql flexible-server parameter set —name audit_log_enabled —resource-group <RESOURCE_GROUP> —server-name <SERVER_NAME> —value ON
References
- https://learn.microsoft.com/en-us/azure/mysql/flexible-server/tutorial-configure-audit
- https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation
- https://learn.microsoft.com/en-us/azure/mysql/flexible-server/scripts/sample-cli-audit-logs
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = mysql_flexible_server_audit_log_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks