Redis has no login screen. That's the point, and the risk.
Classic Azure Cache for Redis has a mode, AuthNotRequired, that does exactly what its name says: no credential of any kind is needed to read or write everything in the cache, only network reachability. Azure Managed Redis, Microsoft's newer service and the one classic Redis is being retired in favour of, doesn't have that same all-or-nothing mode, but it can still be left on access keys instead of Entra ID, or with no Entra access policy assigned to a database at all. ID Posture checks every Redis resource in your connected subscriptions, classic and Managed side by side, on every scan.
Three findings, checked on every scan
Ask your ID Posture contact to enable Redis Security for your tenant.
Why it matters
Classic Redis has a mode, AuthNotRequired, that does exactly what it says: anyone who can reach the cache over the network gets full read/write access with zero verification. Azure Managed Redis (Microsoft's newer service, ahead of classic Redis's own retirement timeline) doesn't have that same all-or-nothing mode, but it can still be left on access keys instead of Entra ID, or with no Entra access policy assigned at all. ID Posture checks every Redis resource in your subscriptions, classic and Managed, on every scan.
Part of ID Posture’s broader Azure resource coverage. See the full product overview, or explore Networking and Key Vault.
It's optional, per tenant, and off by default until you ask for it.