Cis Azure Database 5.2

5.2 Ensure Azure Database for MySQL uses only Microsoft Entra Authentication (Automated)

Profile Applicability

• Level 1

Description

Ensuring that Microsoft Entra Authentication is the only authentication method prevents the local MySQL authentication from being used.

Rationale

The use of a centralized Identity and Access Management (IAM) solution such as Microsoft Entra ID is highly recommended for all activity related to Identity, Authentication, Authorization, and Accountability.

Decentralized IAM -- such as local authentication methods -- may present additional vulnerability and introduce avoidable administrative complexity.

Impact

None specified.

Audit

Audit from Azure Portal

1. From Azure Database for MySQL select a server to audit.
2. Under the Security section, click Authentication.
3. In the main window, under the Authentication header, ensure that "Assign Access to:" reflects the selection of Microsoft Entra authentication only.

Audit From Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.

If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions

• Policy ID: 40e85574-ef33-47e8-a854-7a65c7500560 - Name: 'Azure MySQL flexible server should have Microsoft Entra Only Authentication enabled'

Expected Result

The Authentication setting should show Microsoft Entra authentication only as the selected access method.

Remediation

Remediate from Azure Portal

1. From Azure Database for MySQL select a server to remediate.
2. Under the Security section, click Authentication.
3. In the main window, under the Authentication header where "Assign Access to:" provides three options, select Microsoft Entra authentication only.

Default Value

By default, Azure Database for MySQL uses MySQL authentication only.

References

1. https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-azure-ad
2. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management

CIS Controls