Check ID: mysql_flexible_server_audit_log_enabled
Provider: Azure
Service: mysql
Severity: MEDIUM
Categories: logging
Resource type: microsoft.dbformysql/flexibleservers

What this check verifies

Azure Database for MySQL Flexible Server with audit_log_enabled set to ON generates audit logs for connections, authentication, DDL/DML, and administrative actions.

Risk

Missing audit logs reduces accountability and obscures activity affecting confidentiality and integrity. Unauthorized logins, privilege abuse, or suspicious queries may go undetected, impeding forensics, slowing incident response, and enabling covert data exfiltration.

Recommendation

Enable audit logging (audit_log_enabled=ON) and select events that matter. Export MySqlAuditLogs to a centralized store, enforce least privilege on log access, set retention, and create alerts for anomalies. Regularly review logs as part of defense in depth.

Remediation

az mysql flexible-server parameter set —name audit_log_enabled —resource-group <RESOURCE_GROUP> —server-name <SERVER_NAME> —value ON

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = mysql_flexible_server_audit_log_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks