Check ID: mysql_flexible_server_minimum_tls_version_12
Provider: Azure
Service: mysql
Severity: HIGH
Categories: encryption
Resource type: microsoft.dbformysql/flexibleservers

What this check verifies

Azure Database for MySQL Flexible Server uses the tls_version setting to permit only modern TLS for client connections, requiring TLSv1.2+ and excluding TLSv1.0 and TLSv1.1.

Risk

Allowing legacy TLS (TLSv1.0/TLSv1.1) weakens confidentiality and integrity of data in transit. Attackers can force downgrades and perform man-in-the-middle interception, exposing credentials and queries or altering results, leading to unauthorized access and data exfiltration.

Recommendation

Enforce a minimum TLS of TLSv1.2 (prefer TLSv1.3) and disable TLSv1.0/TLSv1.1. Ensure clients and drivers support modern TLS, deprecate weak cipher suites, and validate in staging. Apply defense in depth with private connectivity and restricted network access.

Remediation

az mysql flexible-server parameter set —resource-group <resourceGroupName> —server-name <serverName> —name tls_version —value TLSv1.2

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = mysql_flexible_server_minimum_tls_version_12. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks