fix: add defense-in-depth SQL Entra-only auth checks - #1678
Merged
Conversation
Add redundant SQL Entra-only auth guidance at the security hardening and generation steps so the prohibition is seen even if the agent skips the sql-database reference chain. Also add a Container Apps + SQL Database research pattern alongside the existing App Service one. Addresses microsoft#1661. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Tom Meschter (tmeschter)
requested review from
kvenkatrajan and
Wallace Breza (wbreza)
as code owners
April 2, 2026 19:31
Contributor
There was a problem hiding this comment.
Pull request overview
This PR strengthens the azure-prepare skill’s “Entra-only Azure SQL auth” guidance by surfacing the prohibition on SQL admin credentials earlier and more frequently in the workflow, reducing the chance the agent generates Bicep with administratorLogin/administratorLoginPassword when azureADOnlyAuthentication: true is required.
Changes:
- Bump
azure-prepareskill version to1.1.4. - Add a security checklist item explicitly forbidding SQL admin login/password properties for Entra-only auth.
- Add a new research pattern and a generation-time security requirement that both point directly to the SQL auth/Bicep reference files.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| plugin/skills/azure-prepare/SKILL.md | Bumps skill metadata version to reflect updated guidance. |
| plugin/skills/azure-prepare/references/security.md | Adds an Identity & Access checklist item to forbid administratorLogin/administratorLoginPassword and links to SQL auth guidance. |
| plugin/skills/azure-prepare/references/research.md | Adds a “Container Apps + API + SQL Database” research pattern that explicitly loads SQL auth/Bicep references. |
| plugin/skills/azure-prepare/references/generate.md | Adds a security requirement to omit SQL admin login/password properties entirely and links to the SQL Bicep reference. |
kvenkatrajan
approved these changes
Apr 2, 2026
This was referenced Apr 2, 2026
Barbara 4bes (Ba4bes)
pushed a commit
to Ba4bes/GitHub-Copilot-for-Azure
that referenced
this pull request
Apr 24, 2026
Add redundant SQL Entra-only auth guidance at the security hardening and generation steps so the prohibition is seen even if the agent skips the sql-database reference chain. Also add a Container Apps + SQL Database research pattern alongside the existing App Service one. Addresses microsoft#1661. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1661.
Problem
In integration test run #135, the
entra-sql-authtest failed because the agent generated SQL Server Bicep containingadministratorLoginPassworddespite correctly settingazureADOnlyAuthentication: true. The root cause: the agent never loaded thesql-database/auth.mdorsql-database/bicep.mdreference files that explicitly prohibit this property. PR #1550 addressed the primary discovery issue by adding more cross-reference links, but the prohibition language still lives only in those leaf reference files.How this helps
This PR adds defense-in-depth by surfacing the SQL Entra-only auth requirement at three workflow stages, so the agent encounters the prohibition even if it shortcuts the reference chain:
research.md— New "Container Apps + API + SQL Database" research pattern (mirrors the existing App Service + SQL pattern) that explicitly loadsauth.mdandbicep.mdsecurity.md— New checklist item in the Identity & Access section: "SQL Server: Entra-only auth — do NOT generateadministratorLoginoradministratorLoginPassword"generate.md— New security requirement: "SQL Server Bicep must use Entra-only auth — omitadministratorLoginandadministratorLoginPasswordentirely"