Azure SQL Server TLS version 1.0 and 1.1 Enabled

Hi Aulia,

The results you are seeing are normal. In your test nmap is running its tests against the Azure SQL Gateway(s). This is not the same as fully establishing an authenticated connection to Azure SQL cluster (via Gateway or direct) using TLS 1.X version. For example, a better test would be to try to connect using SQL Server Management Studio from a PC that is capable of maximum TLS 1.1.

Azure SQL is a multi-tenant Platform-as-a-Service (PaaS) and as a result you are not connecting to a public IP address for a dedicated instance of SQL Server. Instead it is shared by many different customers, some of which may allow TLS 1.0 or 1.1.

Since the service still supports TLS 1.0/1.1 (if customer allows it) the components will still show as supporting these lower versions when performing the type of tests in ssl-enum-ciphers nmap script. Conversely if you attempt to fully connect to your logical Azure SQL Server using a TLS version lower than configured minimum you should receive an error and the connection fail.

Azure SQL Database and Azure Synapse Analytics connectivity architecture

https://zcusa.951200.xyz/en-us/azure/azure-sql/database/connectivity-architecture?view=azuresql#connectivity-architecture

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP