Skip to content

Azure SQL DB server minimum TLS version#

Security · SQL Database · 2020_09

Azure SQL Database servers should reject TLS versions older than 1.2.

Description#

The minimum version of TLS that Azure SQL Database servers accept is configurable. Older TLS versions are no longer considered secure by industry standards, such as PCI DSS.

Azure lets you disable outdated protocols and require connections to use a minimum of TLS 1.2. By default, TLS 1.0, TLS 1.1, and TLS 1.2 is accepted.

Recommendation#

Consider configuring the minimum supported TLS version to be 1.2.

Examples#

Configure with Azure template#

To deploy logical SQL Servers that pass this rule:

  • Set the properties.minimalTlsVersion to 1.2.

For example:

Azure Template snippet
{
    "type": "Microsoft.Sql/servers",
    "apiVersion": "2022-02-01-preview",
    "name": "[parameters('name')]",
    "location": "[parameters('location')]",
    "properties": {
        "minimalTlsVersion": "1.2",
        "administrators": {
            "administratorType": "ActiveDirectory",
            "login": "[parameters('adminLogin')]",
            "principalType": "Group",
            "sid": "[parameters('adminPrincipalId')]",
            "tenantId": "[tenant().tenantId]"
        }
    }
}

Configure with Bicep#

To deploy logical SQL Servers that pass this rule:

  • Set the properties.minimalTlsVersion to 1.2.

For example:

Azure Bicep snippet
resource server 'Microsoft.Sql/servers@2022-02-01-preview' = {
  name: name
  location: location
  properties: {
    minimalTlsVersion: '1.2'
    administrators: {
      administratorType: 'ActiveDirectory'
      login: adminLogin
      principalType: 'Group'
      sid: adminPrincipalId
      tenantId: tenant().tenantId
    }
  }
}
Last update: 2022-10-17

Comments