Back to Checks
azure

SQL Server has an Azure Active Directory administrator configured

sqlserver_azuread_administrator_enabled
Service: sqlserverSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.sql/servers

Azure SQL Server is configured with a Microsoft Entra (Azure AD) administrator at the server scope, indicated by administrator_type set to ActiveDirectory.

Prowler logoProwlerprowler-provider-azure

Risk

Without a Microsoft Entra admin, the server can't use Entra identities, pushing reliance on SQL authentication. This weakens confidentiality and integrity: no MFA/conditional access, harder offboarding and auditing, and compromised passwords can enable unauthorized data access and privilege escalation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks sqlserver_azuread_administrator_enabled

Recommendation

Assign a Microsoft Entra administrator (prefer a security group) at the server level and manage access via Entra groups. Enforce least privilege, require MFA/conditional access, and use managed identities for services. If feasible, adopt Entra-only authentication and phase out shared SQL logins.

Remediation

CLI

az sql server ad-admin create --resource-group <RESOURCE_GROUP> --server <SERVER_NAME> --display-name <AAD_ADMIN_NAME> --object-id <AAD_OBJECT_ID>

Terraform

# Set Microsoft Entra (Azure AD) admin on an existing SQL Server
resource "azurerm_mssql_active_directory_administrator" "<example_resource_name>" {
  server_id = "<example_resource_id>"  # CRITICAL: target SQL server resource ID
  login     = "<AAD_ADMIN_NAME>"        # CRITICAL: AAD admin display name
  object_id = "<AAD_OBJECT_ID>"         # CRITICAL: AAD object (GUID)
  tenant_id = "<TENANT_ID>"             # CRITICAL: Tenant where the AAD object exists
}

NativeIaC

// Configure Microsoft Entra (Azure AD) admin on an existing SQL Server
resource aadAdmin 'Microsoft.Sql/servers/administrators@2021-11-01' = {
  name: '<example_resource_name>/ActiveDirectory' // serverName/ActiveDirectory
  properties: {
    administratorType: 'ActiveDirectory' // CRITICAL: ensures admin type is AAD
    login: '<AAD_ADMIN_NAME>'             // CRITICAL: AAD admin display name
    sid: '<AAD_OBJECT_ID>'                // CRITICAL: AAD object (GUID)
    tenantId: '<TENANT_ID>'               // CRITICAL: Tenant where the AAD object exists
  }
}

Other

1In Azure Portal, go to SQL servers and select <SERVER_NAME>
2Select Active Directory admin
3Click Set admin
4Select the desired Microsoft Entra user or group and click Select
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.sqlserver.sqlserver_client import sqlserver_client


class sqlserver_azuread_administrator_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, sql_servers in sqlserver_client.sql_servers.items():
            subscription_name = sqlserver_client.subscriptions.get(
                subscription, subscription
            )
            for sql_server in sql_servers:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=sql_server
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) has an Active Directory administrator."

                if (
                    sql_server.administrators is None
                    or sql_server.administrators.administrator_type != "ActiveDirectory"
                ):
                    report.status = "FAIL"
                    report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) does not have an Active Directory administrator."

                findings.append(report)

        return findings

References