SQL Server has an Entra ID administrator configured

Check ID: sqlserver_azuread_administrator_enabled
Provider: Azure
Service: sqlserver
Severity: MEDIUM
Categories: identity-access
Resource type: microsoft.sql/servers

What this check verifies

Azure SQL Server is configured with a Microsoft Entra (Azure AD) administrator at the server scope, indicated by administrator_type set to ActiveDirectory.

Risk

Without a Microsoft Entra admin, the server can’t use Entra identities, pushing reliance on SQL authentication. This weakens confidentiality and integrity: no MFA/conditional access, harder offboarding and auditing, and compromised passwords can enable unauthorized data access and privilege escalation.

Recommendation

Assign a Microsoft Entra administrator (prefer a security group) at the server level and manage access via Entra groups. Enforce least privilege, require MFA/conditional access, and use managed identities for services. If feasible, adopt Entra-only authentication and phase out shared SQL logins.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az sql server ad-admin create —resource-group <RESOURCE_GROUP> —server <SERVER_NAME> —display-name <AAD_ADMIN_NAME> —object-id <AAD_OBJECT_ID>

# Set Microsoft Entra (Azure AD) admin on an existing SQL Server
resource "azurerm_mssql_active_directory_administrator" "<example_resource_name>" {
  server_id = "<example_resource_id>"  # CRITICAL: target SQL server resource ID
  login     = "<AAD_ADMIN_NAME>"        # CRITICAL: AAD admin display name
  object_id = "<AAD_OBJECT_ID>"         # CRITICAL: AAD object (GUID)
  tenant_id = "<TENANT_ID>"             # CRITICAL: Tenant where the AAD object exists
}

// Configure Microsoft Entra (Azure AD) admin on an existing SQL Server
resource aadAdmin 'Microsoft.Sql/servers/administrators@2021-11-01' = {
  name: '<example_resource_name>/ActiveDirectory' // serverName/ActiveDirectory
  properties: {
    administratorType: 'ActiveDirectory' // CRITICAL: ensures admin type is AAD
    login: '<AAD_ADMIN_NAME>'             // CRITICAL: AAD admin display name
    sid: '<AAD_OBJECT_ID>'                // CRITICAL: AAD object (GUID)
    tenantId: '<TENANT_ID>'               // CRITICAL: Tenant where the AAD object exists
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = sqlserver_azuread_administrator_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

SQL server auditing retention is over 90 days SQL Server has Microsoft Defender for SQL enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires