Description
Azure SQL requires a Microsoft Entra administrator to use Microsoft Entra authentication. Assigning one does not automatically disable SQL authentication or enforce MFA.
Potential impact
Without this setup, centralized database administration and access control are harder to establish, and operations may rely on individual SQL credentials.
Remediation
Specify the intended administrator account or group in azuread_administrator on azurerm_mssql_server. Configure authentication methods and any required MFA policies for the users and clients involved.
Examples
The examples use current AzureRM administrator settings. Supply the actual administrator display name, object ID, and tenant ID through the variables; do not reuse the illustrative SQL password in production.
Before
hcl
resource "azurerm_resource_group" "example" {
name = "acceptanceTestResourceGroup1"
location = "West US"
}
resource "azurerm_mssql_server" "example" {
name = "mysqlserver1"
resource_group_name = "acceptanceTestResourceGroup1"
location = "West US"
version = "12.0"
administrator_login = "4dm1n157r470r"
administrator_login_password = "4-v3ry-53cr37-p455w0rd"
}
After
hcl
resource "azurerm_resource_group" "example" {
name = "acceptanceTestResourceGroup1"
location = "West US"
}
resource "azurerm_mssql_server" "example" {
name = "mysqlserver1"
resource_group_name = "acceptanceTestResourceGroup1"
location = "West US"
version = "12.0"
administrator_login = "4dm1n157r470r"
administrator_login_password = "4-v3ry-53cr37-p455w0rd"
azuread_administrator {
login_username = var.sql_administrator_display_name
object_id = var.sql_administrator_object_id
tenant_id = var.tenant_id
}
}