Is your SQL Server actually protected, end to end?
An Azure SQL Server can be configured to require Microsoft Entra authentication only, with no other way in, or it can quietly keep SQL logins (a username and password with no connection to your identity provider) alive right alongside it. That's just the start: the same server can also sit wide open on the public internet, run on a TLS version with known weaknesses, or have Microsoft Defender for SQL switched off entirely -- three more ways a server can look fine on the surface while actually being exposed. And encryption at rest isn't guaranteed either: Transparent Data Encryption is on by default for a new database, but a database that's been around a while, or migrated in from elsewhere, can end up with it off and nobody notices. ID Posture checks all of it, server by server and database by database, on every scan.
Seven findings, checked on every scan
Ask your ID Posture contact to enable SQL Security for your tenant.
Why it matters
A SQL login is a username and password with no connection to your identity provider, no Conditional Access, no MFA, no PIM. If a server has no Entra admin at all, SQL logins are the only way in. If it has an Entra admin but still allows SQL authentication, those logins remain a valid, unmonitored way in even after the "real" fix is in place. Beyond authentication, a server left fully open to the public internet with no restriction, or only partially restricted to specific networks, running below the TLS 1.2 baseline, or without Microsoft Defender for SQL watching for threats, is exposed in ways that have nothing to do with who's allowed to log in. And Transparent Data Encryption protects the data at rest itself -- if it's off, anyone who gets hold of the underlying storage gets the data in the clear. ID Posture checks all seven on every scan, at the server level and the database level.
Part of ID Posture’s broader Azure resource coverage. See the full product overview, or explore Cosmos DB Security and Redis Security.
It's optional, per tenant, and off by default until you ask for it.