PostgreSQL Flexible Server has Entra ID authentication

Check ID: postgresql_flexible_server_entra_id_authentication_enabled
Provider: Azure
Service: postgresql
Severity: MEDIUM
Categories: identity-access
Resource type: microsoft.dbforpostgresql/flexibleservers

What this check verifies

PostgreSQL Flexible Servers must set authConfig.activeDirectoryAuth to Enabled and keep at least one Microsoft Entra administrator assigned so database sessions inherit centrally governed identities instead of unmanaged PostgreSQL accounts.

Risk

Without Entra ID authentication, stolen local passwords bypass MFA and conditional access, enabling persistent database logins. Missing administrators leaves the feature unusable, blocking security teams from rotating duties and allowing unauthorized access or privilege escalation.

Recommendation

Federate PostgreSQL Flexible Server access through Microsoft Entra ID so MFA, conditional access, and centralized RBAC govern logins. Maintain at least one delegated administrator group and rotate membership through identity governance processes.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az postgres flexible-server update —resource-group <resourceGroupName> —name <serverName> —active-directory-auth Enabled az postgres flexible-server ad-admin create —resource-group <resourceGroupName> —server-name <serverName> —object-id <objectId> —display-name <displayName> —type User

data "azurerm_client_config" "current" {}

resource "azurerm_postgresql_flexible_server" "example" {
  name                = "pg-flex"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  sku_name            = "GP_Standard_D4s_v3"
  administrator_login = "pgadmin"
  administrator_password = "<complexPassword>"
  storage_mb          = 131072
  version             = "16"

  authentication {
    active_directory_auth_enabled = true
    tenant_id                     = data.azurerm_client_config.current.tenant_id
  }
}

resource "azurerm_postgresql_flexible_server_active_directory_administrator" "entra_admin" {
  server_id     = azurerm_postgresql_flexible_server.example.id
  object_id     = var.entra_object_id
  principal_name = var.entra_principal_name
  principal_type = "User"
  tenant_id     = data.azurerm_client_config.current.tenant_id
}

// Enable Microsoft Entra ID authentication on an existing PostgreSQL Flexible Server
resource server 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {
  name: '<example_resource_name>'
}

// Update server to enable Entra ID authentication
resource serverUpdate 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' = {
  name: server.name
  location: server.location
  properties: {
    authConfig: {
      activeDirectoryAuth: 'Enabled' // CRITICAL: Enables Entra ID authentication
      tenantId: tenant().tenantId
    }
  }
}

// Add Entra ID administrator
resource entraAdmin 'Microsoft.DBforPostgreSQL/flexibleServers/administrators@2023-12-01-preview' = {
  parent: server
  name: '<objectId>' // CRITICAL: Object ID of the Entra ID principal
  properties: {
    principalName: '<displayName>' // User principal name or group display name
    principalType: 'User' // CRITICAL: Can be 'User', 'Group', or 'ServicePrincipal'
    tenantId: tenant().tenantId
  }
  dependsOn: [
    serverUpdate
  ]
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = postgresql_flexible_server_entra_id_authentication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

PostgreSQL Flexible Server enforces SSL connections PostgreSQL Flexible Server has checkpoint logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires