Azure Database for PostgreSQL flexible server should have Microsoft Entra authentication only enabled

What does the recommendation "Azure Database for PostgreSQL flexible server should have Microsoft Entra authentication only enabled" check?

Flags any PostgreSQL flexible server whose authentication configuration still permits native PostgreSQL password logins. The control passes only when authConfig.activeDirectoryAuth is set to Enabled and authConfig.passwordAuth is set to Disabled, so the server accepts Microsoft Entra identities exclusively. It does not check whether an Entra administrator has been provisioned, who holds database roles, or how connections are encrypted, and it does not apply to the older single-server deployment model, which reaches retirement and has its own separate recommendation. A server running in the common 'PostgreSQL and Microsoft Entra authentication' mixed mode still flags here, because a password path remains open.

Why does "Azure Database for PostgreSQL flexible server should have Microsoft Entra authentication only enabled" matter?

While password authentication stays enabled, every PostgreSQL login and its credential lives outside Entra ID, so it sits beyond conditional access, multi-factor enforcement, sign-in risk policies and centralised revocation. A leaked connection string or a service account password reused from a breached system grants a direct route into the database, and offboarding a person means hunting down standalone Postgres roles rather than disabling one Entra account. Restricting the server to Entra-only authentication routes all access through your central identity system, so token lifetimes, MFA and access reviews govern the database the same way they govern everything else, and a single Entra disablement cuts off access instantly.

How do I fix "Azure Database for PostgreSQL flexible server should have Microsoft Entra authentication only enabled"?

1. Provision a Microsoft Entra administrator on the server first, because Entra-only mode rejects the change otherwise: in the portal open the server's Authentication blade, or run 'az postgres flexible-server microsoft-entra-admin create' to assign the admin user or group.
2. Switch the server to Entra-only by setting --microsoft-entra-auth Enabled and --password-auth Disabled, for example 'az postgres flexible-server update --resource-group <rg> --name <server> --microsoft-entra-auth Enabled --password-auth Disabled', or in Bicep set properties.authConfig.activeDirectoryAuth to 'Enabled' and properties.authConfig.passwordAuth to 'Disabled'.
3. Look up the built-in audit policy by its exact display name and assign it so new servers are caught: pid=$(az policy definition list --query "[?displayName=='[Preview]: Azure PostgreSQL flexible server should have Microsoft Entra Only Authentication enabled'].name" -o tsv); az policy assignment create --name pg-entra-only --policy "$pid" --scope <scope>. This policy is audit-only and currently in preview, so it reports drift rather than blocking deployments.

# 1. Lock the wire and the network on a production PostgreSQL flexible server.
RG=db-prod-rg
SRV=ordersprod-pg

# Enforce encrypted connections (dynamic, no restart needed).
az postgres flexible-server parameter set \
  --resource-group "$RG" --server-name "$SRV" \
  --source user-override \
  --name require_secure_transport --value ON

# Pin the minimum TLS version.
az postgres flexible-server parameter set \
  --resource-group "$RG" --server-name "$SRV" \
  --source user-override \
  --name ssl_min_protocol_version --value TLSv1.2

# Disable public network access.
az postgres flexible-server update \
  --resource-group "$RG" --name "$SRV" \
  --public-access Disabled

# 2. Turn on the pgaudit trail and connection throttling.
for p in "pgaudit.log=role,ddl,misc" \
         "pgaudit.log_client=ON" \
         "pgaudit.log_level=log" \
         "pgaudit.log_statement=on" \
         "pgaudit.log_statement_once=on" \
         "connection_throttle.enable=on"; do
  az postgres flexible-server parameter set \
    --resource-group "$RG" --server-name "$SRV" \
    --source user-override \
    --name "${p%%=*}" --value "${p#*=}"
done

# 3. Provision a Microsoft Entra administrator and disable password sign-in.
az postgres flexible-server ad-admin create \
  --resource-group "$RG" --server-name "$SRV" \
  --display-name "dba-team" \
  --object-id "$(az ad group show --group dba-team --query id -o tsv)" \
  --type Group
az postgres flexible-server update \
  --resource-group "$RG" --name "$SRV" \
  --microsoft-entra-auth Enabled --password-auth Disabled

# 4. Ratchet it shut: deny any future PostgreSQL flexible server with public access.
# Look the built-in policy up by its EXACT display name, never paste a guessed GUID.
PID=$(az policy definition list \
  --query "[?displayName=='Public network access should be disabled for PostgreSQL flexible servers'].name" \
  -o tsv)
az policy assignment create \
  --name deny-public-pg-flex \
  --policy "$PID" \
  --params '{"effect":{"value":"Deny"}}' \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"