Back to Checks
azure

SQL server enforces minimal TLS version 1.2 or 1.3

sqlserver_recommended_minimal_tls_version
Service: sqlserverSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.sql/servers

Azure SQL logical servers are assessed for the configured minimum TLS version for client connections. The finding determines whether the minimal accepted version aligns with recommended modern values such as 1.2 or 1.3.

Prowler logoProwlerprowler-provider-azure

Risk

Without a modern minimum, clients can negotiate weak TLS or be downgraded, enabling MITM and decryption. This jeopardizes confidentiality (credential/data exposure) and integrity (query tampering), and may disrupt availability via session resets during handshake interference.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks sqlserver_recommended_minimal_tls_version

Recommendation

Set the minimum TLS to 1.2 or higher (prefer 1.3 when supported). Upgrade client libraries and OS trust stores; remove legacy protocols and weak ciphers to prevent downgrades. Validate compatibility before enforcement and monitor connections for outdated TLS. Uphold encryption in transit and defense in depth.

Remediation

CLI

az sql server update -n <SQL_SERVER_NAME> -g <RESOURCE_GROUP> --set minimalTlsVersion="1.2"

Terraform

# Enforce minimum TLS 1.2 on Azure SQL logical server
resource "azurerm_mssql_server" "<example_resource_name>" {
  name                         = "<example_resource_name>"
  resource_group_name          = "<example_resource_name>"
  location                     = "<example_location>"
  version                      = "12.0"
  administrator_login          = "<example_admin>"
  administrator_login_password = "<example_password>"

  minimum_tls_version = "1.2" # Critical: Enforces TLS 1.2+ for client connections
}

NativeIaC

// Update Azure SQL logical server to enforce minimum TLS 1.2
resource sqlServer 'Microsoft.Sql/servers@2021-11-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  properties: {
    minimalTlsVersion: '1.2' // Critical: Enforces TLS 1.2+ for client connections
  }
}

Other

1In the Azure portal, go to SQL servers and select your server
2Open Networking > Connectivity
3Set Minimum TLS Version to 1.2 (or 1.3)
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.sqlserver.sqlserver_client import sqlserver_client


class sqlserver_recommended_minimal_tls_version(Check):
    def execute(self) -> List[Check_Report_Azure]:
        findings = []
        recommended_minimal_tls_versions = sqlserver_client.audit_config.get(
            "recommended_minimal_tls_versions", ["1.2", "1.3"]
        )
        for subscription, sql_servers in sqlserver_client.sql_servers.items():
            subscription_name = sqlserver_client.subscriptions.get(
                subscription, subscription
            )
            for sql_server in sql_servers:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=sql_server
                )
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) is using TLS version {sql_server.minimal_tls_version} as minimal accepted which is not recommended. Please use one of the recommended versions: {', '.join(recommended_minimal_tls_versions)}."
                if sql_server.minimal_tls_version in recommended_minimal_tls_versions:
                    report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription_name} ({subscription}) is using version {sql_server.minimal_tls_version} as minimal accepted which is recommended."
                    report.status = "PASS"
                findings.append(report)

        return findings

References