Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Reference · Draft

Microsoft Practice Crosswalk: Entra, Intune, National Clouds, Arc and SQL

An explainer: each practice the books recommend, the Microsoft page that defines it, the ScubaGear policy or Azure Policy built-in that checks it, and when the row was last reviewed

Research draft: a crosswalk from the Entra ID, Intune, national-cloud endpoint, Azure Arc and SQL practices in Books 02, 04, 05, 06, 10 and 15 to the canonical Microsoft Learn page, the CISA ScubaGear policy ID or Azure Policy built-in definition that checks each one, and the date each row was last reviewed.
Modified

October 25, 2026

Status — Draft

This page is still being written. Expect gaps and changes; it is not part of the workbook's production guidance. Last reviewed 2026-10-25.

The books recommend Microsoft practices chapter by chapter: block legacy authentication, require phishing-resistant MFA, put privileged roles behind PIM, make device compliance the access signal, connect servers through Azure Arc, and move SQL Server to Entra authentication. This page puts those practices in one table, so that a reviewer can see for each one where Microsoft defines it, which automated check confirms it, and how fresh the row is.

Each row gives four things:

NoteWhy the review date matters

Microsoft pages, ScubaGear policy IDs and Azure Policy names all change. ScubaGear released version 2.0.0 on October 22, 2026, and one policy the books cite now has a different version number in ScubaGear than in CISA’s BOD 25-01 list (see What this found). A crosswalk row is only as good as its last review, so every row carries one, and the page’s last-reviewed date drives the review date in its status box and the weekly source-watch issue.

Entra ID

The ScubaGear Entra ID baseline (aad.md) is the source for every ID below, as of the version published with ScubaGear 2.0.0.2 The IDs match the ones the books already cite, apart from the one listed under What this found. Where the BOD 25-01 Required Configurations list, which binds federal civilian agencies, still uses an older ID, the row gives both.3

Practice Book Microsoft page ScubaGear policy Reviewed
Block legacy authentication Book 04, Ch 07 Block legacy authentication with Conditional Access4 MS.AAD.1.1v1 (SHALL) 2026-10-25
Block high-risk users and high-risk sign-ins; notify administrators of high-risk users Book 04, Ch 03 Risk policies, Microsoft Entra ID Protection5 MS.AAD.2.1v1, MS.AAD.2.3v1 (SHALL); MS.AAD.2.2v1 (SHOULD) 2026-10-25
Phishing-resistant MFA for all users, with MFA for everyone until then Book 04, Ch 07 Conditional Access authentication strengths6 MS.AAD.3.1v1, MS.AAD.3.2v2 (SHALL); BOD 25-01 list: MS.AAD.3.2v1 2026-10-25
Phishing-resistant MFA for highly privileged roles Book 04, Ch 04 Conditional Access authentication strengths7 MS.AAD.3.6v1 (SHALL) 2026-10-25
Finish the move to the Authentication methods policy; turn off SMS, voice and email one-time passcodes; show sign-in context in Authenticator Book 02, Ch 10 How to migrate to the Authentication methods policy8 MS.AAD.3.4v1, MS.AAD.3.5v2, MS.AAD.3.3v2 (SHALL) 2026-10-25
Require managed devices to sign in and to register MFA Book 04, Ch 07 Device compliance policies in Microsoft Intune9 MS.AAD.3.7v1, MS.AAD.3.8v1 (SHOULD) 2026-10-25
Block the device code flow Book 04, Ch 07 Block authentication flows with Conditional Access10 MS.AAD.3.9v1 (SHOULD) 2026-10-25
Send Entra logs to the security operations center Book 12, Ch 03 Stream Microsoft Entra logs to an event hub11 MS.AAD.4.1v1 (SHALL, manual check) 2026-10-25
Only administrators register applications; restrict user consent; run an admin consent workflow Book 04, Ch 05 Configure how users consent to applications12; Configure the admin consent workflow13 MS.AAD.5.1v1, MS.AAD.5.2v1, MS.AAD.5.3v1 (SHALL) 2026-10-25
Block application passwords; cap password lifetime at 180 days and certificate lifetime at 365 days Book 04, Ch 05 Configure restrictions on how applications can be configured14 MS.AAD.5.5v1, MS.AAD.5.6v1, MS.AAD.5.7v1 (SHOULD) 2026-10-25
Two to eight Global Administrators as the baseline (Book 04 sets the stricter target of fewer than five); finer-grained roles instead; cloud-only privileged accounts Book 04, Ch 04 Best practices for Microsoft Entra roles15 MS.AAD.7.1v1, MS.AAD.7.2v1, MS.AAD.7.3v1 (SHALL) 2026-10-25
No permanent active assignments to highly privileged roles; assign them only through PIM; approve Global Administrator activation; alert on assignments and activations Book 04, Ch 08 What is Privileged Identity Management?16 MS.AAD.7.4v1 to MS.AAD.7.8v1 (SHALL); MS.AAD.7.9v1 (SHOULD) 2026-10-25
Limit guest access, guest invitations and invitation domains Book 04, Ch 09 Configure external collaboration17 MS.AAD.8.1v1, MS.AAD.8.2v1, MS.AAD.8.3v1 (SHOULD) 2026-10-25

Intune

ScubaGear has no Intune baseline. Its baselines cover Entra ID, the security suite, Exchange Online, Power BI, Power Platform, SharePoint and OneDrive, and Teams; a placeholder baseline for Super Intelligence (SI) and SI agents in Microsoft 365, added on November 4, 2026, has no policies yet.18 Intune practices are therefore checked by reading Intune’s own configuration through Microsoft Graph, as Book 15, Chapter 08 describes. The one ScubaGear tie is indirect: MS.AAD.3.7v1 and 3.8v1 require managed devices in Conditional Access, and Intune compliance is what makes a device count as managed.

Practice Book Microsoft page Check Reviewed
Device compliance policies as the Conditional Access signal Book 05, Ch 10 Device compliance policies in Microsoft Intune19 No ScubaGear policy; supports MS.AAD.3.7v1 2026-10-25
Security baselines in place of Group Policy Book 05, Ch 08 Intune security baselines for Windows devices20 No ScubaGear policy; read through Graph 2026-10-25
Windows Autopilot onboarding Book 05, Ch 04 Overview of Windows Autopilot21 No ScubaGear policy 2026-10-25
Intune role-based access control and Multi Admin Approval Book 05, Ch 06 Role-based access control with Microsoft Intune22; Use Multi Admin Approval in Intune23 No ScubaGear policy 2026-10-25
Read and evidence Intune configuration through Microsoft Graph Book 15, Ch 08 Working with Intune in Microsoft Graph24 No ScubaGear policy 2026-10-25

National-cloud endpoints

These rows aren’t settings, so there’s no check to map. They decide which endpoints every script and collector in the books has to call, so they’re reviewed on the same schedule.

Practice Book Microsoft page What the page says Reviewed
A Microsoft 365 GCC tenant uses the worldwide endpoints Book 10, Ch 04 Microsoft Graph national cloud deployments25 https://graph.microsoft.com and https://portal.azure.com 2026-10-25
A GCC High tenant uses the US Government L4 endpoints Book 10, Ch 04 Microsoft Graph national cloud deployments26 https://graph.microsoft.us, https://portal.azure.us, sign-in at https://login.microsoftonline.us 2026-10-25
A DoD tenant uses the US Government L5 endpoints Book 10, Ch 04 Microsoft Graph national cloud deployments27 https://dod-graph.microsoft.us and https://portal.azure.us 2026-10-25
Intune GCC is the commercial instance; GCC High and DoD are a separate government instance, with no built-in migration between them Book 05, Ch 04 Microsoft Intune Government Service overview28 Devices moving between the two must unenroll and re-enroll 2026-10-25

Graph Explorer isn’t supported on the GCC High, DoD or China endpoints,29 so a query written and tested in Graph Explorer has to be retested against the government endpoint before a GCC High or DoD collector uses it (design guidance).

Azure Arc

The Azure Policy names below are the display names in Microsoft’s built-in reference for Arc-enabled servers.30

Practice Book Microsoft page Azure Policy built-in Reviewed
Connect servers to Arc over Private Link, not the public internet Book 05, Ch 09 Use Azure Private Link to connect servers to Azure Arc31 “Azure Arc-enabled servers should be configured with an Azure Arc Private Link Scope”; “Azure Arc Private Link Scopes should disable public network access” 2026-10-25
Keep the agent’s network path to the documented endpoints Book 05, Ch 09 Connected Machine agent network requirements32 None; review the endpoint list for the cloud in use 2026-10-25
Use the Arc managed identity, not stored secrets, for access to Azure resources Book 06, R04 Access Azure resources with managed identity on Azure Arc-enabled servers33 None that fits. The “[Preview]: A managed identity should be enabled on your machines” built-in applies only to resources managed by Automanage 2026-10-25
Assess and install updates through Azure Update Manager Book 05, Ch 09 Azure Update Manager overview34 “Machines should be configured to periodically check for missing system updates”; “System updates should be installed on your machines (powered by Update Center)” 2026-10-25
Keep extensions current Book 05, Ch 09 Automatic extension upgrade for Azure Arc-enabled servers35 “Configure Azure Arc-enabled Servers to enable automatic upgrades” 2026-10-25
Collect server telemetry with the Azure Monitor Agent Book 05, Ch 09 Azure Monitor Agent overview36 “Windows Arc-enabled machines should have Azure Monitor Agent installed”; “Linux Arc-enabled machines should have Azure Monitor Agent installed” 2026-10-25

SQL Server and Azure SQL

The Arc rows come from the Arc built-in reference;37 the Azure SQL rows come from Microsoft’s built-in reference for Azure SQL and the definitions themselves in the Azure Policy repository.38

Practice Book Microsoft page Azure Policy built-in Reviewed
SQL Server 2022 and later on premises authenticates with Entra ID through Arc Book 06, Ch 12 Microsoft Entra authentication for SQL Server overview39 None found. Neither built-in reference has a definition that audits Entra authentication on Arc-enabled SQL Server 2026-10-25
Protect Arc-enabled SQL Server with Defender for SQL and resolve its findings Book 06, Ch 09 Azure Policy built-ins for Arc-enabled servers40 “Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL”; “SQL servers on machines should have vulnerability findings resolved” 2026-10-25
Azure SQL: set an Entra administrator, then turn on Entra-only authentication Book 06, Ch 06 Configure Microsoft Entra authentication41; Microsoft Entra-only authentication42 “An Azure Active Directory administrator should be provisioned for SQL servers”; “Azure SQL Database should have Microsoft Entra-only authentication enabled” (and “… enabled during creation”); “Azure SQL Managed Instance should have Microsoft Entra-only authentication enabled” 2026-10-25
Azure SQL: TLS 1.2 or newer and no public network access Not yet recommended in a book; Book 06, Ch 19 shows only Encrypt=True in a connection string Connectivity settings43 “Azure SQL Database should be running TLS version 1.2 or newer”; “Public network access on Azure SQL Database should be disabled” 2026-10-25
Azure SQL: auditing on Book 06, R09 Auditing for Azure SQL Database44 “Auditing on SQL server should be enabled” 2026-10-25

Two notes on the SQL names. The Entra administrator built-in still carries its Azure Active Directory name, at version 1.0.0, even though Microsoft’s documentation now says Microsoft Entra;45 search for it under the old name. And Azure Policy can only stop a server from being created without Entra-only authentication: an authorized user can turn it off afterwards, and the server then shows as non-compliant rather than being blocked.46

What this found

  • One policy has two version numbers. Book 02, Appendix A and Book 04, Chapter 07 cite MS.AAD.3.2v1, “if phishing-resistant MFA isn’t enforced yet, enforce an alternative MFA method”, as CISA’s BOD 25-01 Required Configurations list still gives it.47 The ScubaGear 2.0.0 baseline has MS.AAD.3.2v2, “MFA SHALL be enforced for all users”, last modified February 2026,48 so a ScubaGear report shows 3.2v2. Both books now keep the directive’s ID and note ScubaGear’s. Every other MS.AAD ID cited in the books and decks matches both.
  • Intune has no ScubaGear coverage, so the Intune rows depend on the Graph evidence approach in Book 15.
  • Arc-enabled SQL Server has no built-in policy for Entra authentication. Proving it needs a custom check, for example a query of the instance’s logins, which is the authentication audit in Book 06, Chapter 07 (inference).

Status and review

Draft. Every row was checked against its source on October 25, 2026: the ScubaGear 2.0.0 Entra baseline, Microsoft Learn, and Microsoft’s built-in Azure Policy references and definitions. To move this page to In review, a reviewer should confirm each row and check the book links. To move it to Proved, run ScubaGear and an Azure Policy compliance scan in a test tenant and subscription, record which rows pass, and add the evidence here.

Keeping it fresh. The page’s last-reviewed date shows in the status box above. Any page with a status label not reviewed for more than 90 days is flagged in the box, and listed in the weekly source-watch issue until someone reviews it. When you review a row, update its date; when you review the whole page, update last-reviewed. Comments and corrections are welcome as issues on GitHub.

Related: the Microsoft automation reference, Module 1: Foundations and Module 2: Microsoft Entra ID; Book 04 — Access & Privilege, Book 05 — Devices & Endpoints, Book 06 — Data Platform, Book 10 — Cloud Boundary and Book 15 — Day-2 Operations.

Back to top

Footnotes

  1. CISA, ScubaGear, “Microsoft Entra ID” secure configuration baseline (aad.md, policies MS.AAD.1.1v1 to MS.AAD.9.1v1; file last changed October 22, 2026, with release v2.0.0), https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md, accessed October 25, 2026.↩︎

  2. CISA, ScubaGear, “Microsoft Entra ID” secure configuration baseline (aad.md, policies MS.AAD.1.1v1 to MS.AAD.9.1v1; file last changed October 22, 2026, with release v2.0.0), https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md, accessed October 25, 2026.↩︎

  3. Cybersecurity and Infrastructure Security Agency, “BOD 25-01: Implementing Secure Practices for Cloud Services, Required Configurations” (lists MS.AAD.3.2v1), https://www.cisa.gov/resources-tools/services/bod-25-01-implementing-secure-practices-cloud-services-required-configurations, accessed October 25, 2026.↩︎

  4. Microsoft Learn, “Block legacy authentication with Conditional Access” (updated March 24, 2026), https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication, accessed October 25, 2026.↩︎

  5. Microsoft Learn, “Risk policies” (updated October 30, 2025), https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies, accessed October 25, 2026.↩︎

  6. Microsoft Learn, “Overview of Conditional Access authentication strengths” (updated March 4, 2025), https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths, accessed October 25, 2026.↩︎

  7. Microsoft Learn, “Overview of Conditional Access authentication strengths” (updated March 4, 2025), https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths, accessed October 25, 2026.↩︎

  8. Microsoft Learn, “How to migrate to the Authentication methods policy” (updated January 15, 2026), https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-methods-manage, accessed October 25, 2026.↩︎

  9. Microsoft Learn, “Device compliance policies in Microsoft Intune” (updated July 2, 2026), https://learn.microsoft.com/en-us/intune/device-security/compliance/overview, accessed October 25, 2026.↩︎

  10. Microsoft Learn, “Block authentication flows with Conditional Access policy” (updated March 24, 2026), https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows, accessed October 25, 2026.↩︎

  11. Microsoft Learn, “Stream Microsoft Entra logs to an event hub” (updated September 27, 2024), https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-stream-logs-to-event-hub, accessed October 25, 2026.↩︎

  12. Microsoft Learn, “Configure how users consent to applications” (updated June 15, 2025), https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent, accessed October 25, 2026.↩︎

  13. Microsoft Learn, “Configure the admin consent workflow” (updated December 29, 2024), https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow, accessed October 25, 2026.↩︎

  14. Microsoft Learn, “Configure restrictions on how applications can be configured” (app management policies; updated July 23, 2025), https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies, accessed October 25, 2026.↩︎

  15. Microsoft Learn, “Best practices for Microsoft Entra roles” (updated June 1, 2026), https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices, accessed October 25, 2026.↩︎

  16. Microsoft Learn, “What is Privileged Identity Management?” (updated April 23, 2026), https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure, accessed October 25, 2026.↩︎

  17. Microsoft Learn, “Configure external collaboration” (updated April 24, 2026), https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure, accessed October 25, 2026.↩︎

  18. CISA, ScubaGear repository, baselines folder, https://github.com/cisagov/ScubaGear/tree/main/PowerShell/ScubaGear/baselines, accessed October 25, 2026; re-read November 9, 2026 (si.md, “CISA M365 Secure Configuration Baseline for Super Intelligence (SI) / SI Agents capabilities”, added at commit 8c954fc with its description and policies marked TBD).↩︎

  19. Microsoft Learn, “Device compliance policies in Microsoft Intune” (updated July 2, 2026), https://learn.microsoft.com/en-us/intune/device-security/compliance/overview, accessed October 25, 2026.↩︎

  20. Microsoft Learn, “Learn about Intune security baselines for Windows devices” (updated September 30, 2026), https://learn.microsoft.com/en-us/intune/device-security/security-baselines/overview, accessed October 25, 2026.↩︎

  21. Microsoft Learn, “Overview of Windows Autopilot” (updated June 13, 2025), https://learn.microsoft.com/en-us/autopilot/overview, accessed October 25, 2026.↩︎

  22. Microsoft Learn, “Role-based access control (RBAC) with Microsoft Intune” (updated March 24, 2026), https://learn.microsoft.com/en-us/intune/fundamentals/role-based-access-control/overview, accessed October 25, 2026.↩︎

  23. Microsoft Learn, “Use Multi Admin Approval in Intune” (updated July 30, 2026), https://learn.microsoft.com/en-us/intune/fundamentals/role-based-access-control/multi-admin-approval, accessed October 25, 2026.↩︎

  24. Microsoft Learn, “Working with Intune in Microsoft Graph” (updated September 25, 2024), https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview, accessed October 25, 2026.↩︎

  25. Microsoft Learn, “Microsoft Graph national cloud deployments” (updated January 30, 2025): GCC tenants “continue using the worldwide endpoints”; GCC High uses graph.microsoft.us and portal.azure.us; DoD uses dod-graph.microsoft.us; Graph Explorer is not supported on the national clouds, https://learn.microsoft.com/en-us/graph/deployments, accessed October 25, 2026.↩︎

  26. Microsoft Learn, “Microsoft Graph national cloud deployments” (updated January 30, 2025): GCC tenants “continue using the worldwide endpoints”; GCC High uses graph.microsoft.us and portal.azure.us; DoD uses dod-graph.microsoft.us; Graph Explorer is not supported on the national clouds, https://learn.microsoft.com/en-us/graph/deployments, accessed October 25, 2026.↩︎

  27. Microsoft Learn, “Microsoft Graph national cloud deployments” (updated January 30, 2025): GCC tenants “continue using the worldwide endpoints”; GCC High uses graph.microsoft.us and portal.azure.us; DoD uses dod-graph.microsoft.us; Graph Explorer is not supported on the national clouds, https://learn.microsoft.com/en-us/graph/deployments, accessed October 25, 2026.↩︎

  28. Microsoft Learn, “Microsoft Intune Government Service overview” (updated October 2, 2026): Intune has no separate GCC instance, GCC High and DoD share the government instance, and there’s no built-in migration between the commercial service and the government cloud, https://learn.microsoft.com/en-us/intune/fundamentals/government-service, accessed October 25, 2026.↩︎

  29. Microsoft Learn, “Microsoft Graph national cloud deployments” (updated January 30, 2025): GCC tenants “continue using the worldwide endpoints”; GCC High uses graph.microsoft.us and portal.azure.us; DoD uses dod-graph.microsoft.us; Graph Explorer is not supported on the national clouds, https://learn.microsoft.com/en-us/graph/deployments, accessed October 25, 2026.↩︎

  30. Microsoft Learn, “Azure Policy built-in definitions for Azure Arc-enabled servers” (updated February 12, 2026), https://learn.microsoft.com/en-us/azure/azure-arc/servers/policy-reference, accessed October 25, 2026.↩︎

  31. Microsoft Learn, “Use Azure Private Link to connect servers to Azure Arc by using a private endpoint” (updated May 4, 2026), https://learn.microsoft.com/en-us/azure/azure-arc/servers/private-link-security, accessed October 25, 2026.↩︎

  32. Microsoft Learn, “Connected Machine agent network requirements” (updated April 1, 2026), https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements, accessed October 25, 2026.↩︎

  33. Microsoft Learn, “Access Azure resources with managed identity on Azure Arc-enabled servers” (updated February 5, 2026), https://learn.microsoft.com/en-us/azure/azure-arc/servers/managed-identity-authentication, accessed October 25, 2026.↩︎

  34. Microsoft Learn, “Azure Update Manager overview” (updated February 3, 2025), https://learn.microsoft.com/en-us/azure/update-manager/overview, accessed October 25, 2026.↩︎

  35. Microsoft Learn, “Automatic extension upgrade for Azure Arc-enabled servers” (updated November 11, 2025), https://learn.microsoft.com/en-us/azure/azure-arc/servers/manage-automatic-vm-extension-upgrade, accessed October 25, 2026.↩︎

  36. Microsoft Learn, “Azure Monitor Agent overview” (updated April 9, 2026), https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview, accessed October 25, 2026.↩︎

  37. Microsoft Learn, “Azure Policy built-in definitions for Azure Arc-enabled servers” (updated February 12, 2026), https://learn.microsoft.com/en-us/azure/azure-arc/servers/policy-reference, accessed October 25, 2026.↩︎

  38. Microsoft Learn, “Built-in policy definitions for Azure SQL Database”, https://learn.microsoft.com/en-us/azure/azure-sql/database/policy-reference; and the definitions in the Azure Policy repository, e.g. SQL_DB_AuditServerADAdmins_Audit.json (display name “An Azure Active Directory administrator should be provisioned for SQL servers”, version 1.0.0), https://github.com/Azure/azure-policy/tree/master/built-in-policies/policyDefinitions/SQL, both accessed October 25, 2026.↩︎

  39. Microsoft Learn, “Microsoft Entra authentication for SQL Server overview” (updated November 4, 2025), https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/azure-ad-authentication-sql-server-overview, accessed October 25, 2026.↩︎

  40. Microsoft Learn, “Azure Policy built-in definitions for Azure Arc-enabled servers” (updated February 12, 2026), https://learn.microsoft.com/en-us/azure/azure-arc/servers/policy-reference, accessed October 25, 2026.↩︎

  41. Microsoft Learn, “Configure Microsoft Entra authentication” for Azure SQL Database and SQL Managed Instance (updated October 7, 2026), https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure, accessed October 25, 2026.↩︎

  42. Microsoft Learn, “Microsoft Entra-only authentication” for Azure SQL Database and SQL Managed Instance (updated October 7, 2026): the Entra administrator must be set first, https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication, accessed October 25, 2026.↩︎

  43. Microsoft Learn, “Connectivity settings” for Azure SQL Database (updated October 20, 2026), https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings, accessed October 25, 2026.↩︎

  44. Microsoft Learn, “Auditing for Azure SQL Database” (updated October 5, 2026), https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview, accessed October 25, 2026.↩︎

  45. Microsoft Learn, “Built-in policy definitions for Azure SQL Database”, https://learn.microsoft.com/en-us/azure/azure-sql/database/policy-reference; and the definitions in the Azure Policy repository, e.g. SQL_DB_AuditServerADAdmins_Audit.json (display name “An Azure Active Directory administrator should be provisioned for SQL servers”, version 1.0.0), https://github.com/Azure/azure-policy/tree/master/built-in-policies/policyDefinitions/SQL, both accessed October 25, 2026.↩︎

  46. Microsoft Learn, “Azure Policy for Microsoft Entra-only authentication with Azure SQL” (limitations), https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication-policy, accessed October 25, 2026.↩︎

  47. Cybersecurity and Infrastructure Security Agency, “BOD 25-01: Implementing Secure Practices for Cloud Services, Required Configurations” (lists MS.AAD.3.2v1), https://www.cisa.gov/resources-tools/services/bod-25-01-implementing-secure-practices-cloud-services-required-configurations, accessed October 25, 2026.↩︎

  48. CISA, ScubaGear, “Microsoft Entra ID” secure configuration baseline (aad.md, policies MS.AAD.1.1v1 to MS.AAD.9.1v1; file last changed October 22, 2026, with release v2.0.0), https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md, accessed October 25, 2026.↩︎