# Cis Azure Database 5.2

> Ensure Azure Database for MySQL uses only Microsoft Entra Authentication

- Skill: `cyberstrikeus/cis-azure-database-5-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-database-5-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-database-5-2/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-database-5-2

---


# 5.2 Ensure Azure Database for MySQL uses only Microsoft Entra Authentication (Automated)

## Profile Applicability

- Level 1

## Description

Ensuring that Microsoft Entra Authentication is the only authentication method prevents the local MySQL authentication from being used.

## Rationale

The use of a centralized Identity and Access Management (IAM) solution such as Microsoft Entra ID is highly recommended for all activity related to Identity, Authentication, Authorization, and Accountability.

Decentralized IAM -- such as local authentication methods -- may present additional vulnerability and introduce avoidable administrative complexity.

## Impact

None specified.

## Audit

### Audit from Azure Portal

1. From `Azure Database for MySQL` select a server to audit.
2. Under the Security section, click `Authentication`.
3. In the main window, under the Authentication header, ensure that "Assign Access to:" reflects the selection of `Microsoft Entra authentication only`.

### Audit From Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.

If referencing a printed copy, you can search Policy IDs from this URL:
https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions

- **Policy ID:** `40e85574-ef33-47e8-a854-7a65c7500560` - **Name:** 'Azure MySQL flexible server should have Microsoft Entra Only Authentication enabled'

## Expected Result

The Authentication setting should show `Microsoft Entra authentication only` as the selected access method.

## Remediation

### Remediate from Azure Portal

1. From `Azure Database for MySQL` select a server to remediate.
2. Under the Security section, click `Authentication`.
3. In the main window, under the Authentication header where "Assign Access to:" provides three options, select `Microsoft Entra authentication only`.

## Default Value

By default, Azure Database for MySQL uses `MySQL authentication only`.

## References

1. https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-azure-ad
2. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management

## CIS Controls

| Controls Version | Control                                            | IG 1 | IG 2 | IG 3 |
| ---------------- | -------------------------------------------------- | ---- | ---- | ---- |
| v8               | 5.6 Centralize Account Management                  |      | X    | X    |
| v7               | 16.2 Configure Centralized Point of Authentication |      | X    | X    |