Azure SQL Database should be running TLS version 1.2 or newer

What does the recommendation "Azure SQL Database should be running TLS version 1.2 or newer" check?

Flags any logical SQL server (Microsoft.Sql/servers) whose 'minimalTlsVersion' property is set below 1.2, or left unset, so the server still accepts client connections that negotiate TLS 1.0 or 1.1. The check is read at the server level and applies to every database under that server. It does not cover Azure SQL Managed Instance, which has its own separate recommendation and setting, and it does not inspect the TLS version a given client actually uses, only the floor the server will permit. Note that the built-in policy treats a 'minimalTlsVersion' of 'None' as compliant even though that value allows legacy TLS, so an unconfigured server can pass the audit while still being exposed.

Why does "Azure SQL Database should be running TLS version 1.2 or newer" matter?

TLS 1.0 and 1.1 carry well documented weaknesses, including BEAST and downgrade behaviour, that let an attacker positioned on the network path intercept or tamper with traffic between an application and the database. Because the floor is set per server, one server left on a legacy minimum quietly weakens transport security for every database it hosts, including those holding regulated or personal data. Microsoft is force upgrading servers off TLS 1.0 and 1.1 and will deny those connections, so a server left below 1.2 is both an audit finding and a future outage waiting to happen when older clients are cut off without warning. Raising the floor to 1.2 closes the downgrade path and aligns the estate with the platform's own deprecation timeline.

How do I fix "Azure SQL Database should be running TLS version 1.2 or newer"?

1. Set the minimum TLS version to 1.2 on the logical SQL server with the Azure CLI: az sql server update -n <server-name> -g <resource-group> --set minimalTlsVersion="1.2". In the portal the same control lives under the server's Networking blade as 'Minimum TLS version'.
2. Pin the setting in your Bicep so new servers ship compliant: set 'minimalTlsVersion: '1.2'' in the Microsoft.Sql/servers resource properties, rather than relying on operators to remember the portal toggle.
3. Enforce it estate-wide by assigning the built-in audit policy, looked up by display name so no GUID is hardcoded: pid=$(az policy definition list --query "[?displayName=='Azure SQL Database should be running TLS version 1.2 or newer'].name" -o tsv); az policy assignment create --name sql-min-tls-12 --policy "$pid" --scope <subscription-or-management-group-scope>.

# Close the highest-impact plaintext doors first: the Redis non-SSL port,
# then HTTPS-only + a modern TLS floor on every web app.

# Redis: disable the non-SSL port 6379 and require TLS 1.2 (clients use 6380).
for cache in $(az redis list --query "[?enableNonSslPort].name" -o tsv); do
  rg=$(az redis list --query "[?name=='$cache'].resourceGroup" -o tsv)
  az redis update --name "$cache" --resource-group "$rg" \
    --set enableNonSslPort=false minimumTlsVersion=1.2
  echo "$cache: non-SSL port disabled, min TLS 1.2"
done

# Web apps: enforce HTTPS only and raise the TLS floor.
for app in $(az webapp list --query "[?httpsOnly==\`false\`].name" -o tsv); do
  rg=$(az webapp list --query "[?name=='$app'].resourceGroup" -o tsv)
  az webapp update --name "$app" --resource-group "$rg" --https-only true
  az webapp config set --name "$app" --resource-group "$rg" --min-tls-version 1.2
  echo "$app: HTTPS only, min TLS 1.2"
done

# Functions follow the same pattern with az functionapp update --set httpsOnly=true.

# Ratchet it shut: assign the built-in deny policy for web apps over HTTPS only.
az policy assignment create \
  --name require-https-webapp \
  --policy a4af4a39-4135-47fb-b175-47fbdf85311d \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"