Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
sqlserver_recommended_minimal_tls_versionProvider: Azure
Service:
sqlserverSeverity: MEDIUM
Categories:
encryptionResource type:
microsoft.sql/serversWhat this check verifies
Azure SQL logical servers are assessed for the configured minimum TLS version for client connections. The finding determines whether the minimal accepted version aligns with recommended modern values such as1.2 or 1.3.
Risk
Without a modern minimum, clients can negotiate weak TLS or be downgraded, enabling MITM and decryption. This jeopardizes confidentiality (credential/data exposure) and integrity (query tampering), and may disrupt availability via session resets during handshake interference.Recommendation
Set the minimum TLS to1.2 or higher (prefer 1.3 when supported). Upgrade client libraries and OS trust stores; remove legacy protocols and weak ciphers to prevent downgrades. Validate compatibility before enforcement and monitor connections for outdated TLS. Uphold encryption in transit and defense in depth.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/Sql/db-minimum-tls-version-check.html
- https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings?view=azuresql&tabs=azure-portal#configure-minimum-tls-version
- https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/minimal-tls-version-configure?view=azuresql
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = sqlserver_recommended_minimal_tls_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks