Azure SQL Managed Instance must map the PKI-authenticated identity to an associated user account.

The DOD standard for authentication is DOD-approved PKI certificates. Once a PKI certificate has been validated, it must be mapped to an Azure SQL Managed Instance database user account or login for the authenticated identity to be meaningful to Azure SQL Managed Instance and useful for authorization decisions.

Determine if Azure SQL Managed Instance is configured to use Microsoft Entra ID authentication only.

To verify Azure Active Directory is configured as the authentication type, use the following PowerShell commands:

Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Get-AzSqlInstanceActiveDirectoryOnlyAuthentication

If AzureADOnlyAuthentication returns "True", this is not a finding.

If AzureADOnlyAuthentication returns "False" and the need for mixed mode authentication has not been documented and approved, this is a finding.

To set the Entra ID Administrator, use the following PowerShell command:

Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Set-AzSqlInstanceActiveDirectoryAdministrator -DisplayName '<Entra Admin User/Group Name>'

To enable Entra ID only authentication, use the following PowerShell command:

Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Enable-AzSqlInstanceActiveDirectoryOnlyAuthentication

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?view=azuresql-mi&amp;tabs=azure-powershell