PostgreSQL flexible servers should have Microsoft Entra ID authentication enabled
PostgreSQL Flexible Servers must set `authConfig.activeDirectoryAuth` to `Enabled`. They must also keep at least one Microsoft Entra administrator assigned so database sessions inherit centrally governed identities instead of unmanaged PostgreSQL accounts.
Without Entra ID authentication, stolen local passwords bypass MFA and conditional access, enabling persistent database logins. Missing administrators leaves the feature unusable, blocking security teams from rotating duties and allowing unauthorized access or privilege escalation.
What this control checks
PostgreSQL flexible servers must have Microsoft Entra ID authentication enabled.
Common pitfalls
Missing administrators block security duty rotation
Without Microsoft Entra administrators configured, the feature is unusable, which blocks security teams from rotating duties and allows unauthorized access or privilege escalation.
Audit evidence
Evidence that deployed resources meet this control: Prowler check postgresql_flexible_server_entra_id_authentication_enabled (prowler azure --checks postgresql_flexible_server_entra_id_authentication_enabled).
Framework-specific interpretation
RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-7-2 (Annex I (7.2) - Passwords should be set as complex and lengthy and users should not use same passwords for all the...).
HIPAA Security Rule 2003: Mapped to 164.312(a)(2)(i) (Unique user identification) and 164.312(d) (Person or entity authentication).
Framework mappings
The clauses this control is mapped to in each framework.
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- 164.312(a)(2)(i) Unique user identification
- 164.312(d) Person or entity authentication
Related controls
- PostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'
- PostgreSQL flexible servers should have log_disconnections enabled
- Network security groups should limit inbound TCP port 5432 access from the internet
- Microsoft Entra ID tenants should have a multifactor authentication policy configured for all users
- Cognitive Search services should use managed identity
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_postgresql_flexible_server_entra_id_authentication_enabled - Prowler Check:
postgresql_flexible_server_entra_id_authentication_enabled
Last reviewed: 2026-10-11