Skills azure-postgres

📦

azure-postgres

Name: azure-postgres
Author: microsoft

Content revision r1 High Risk 📁 Filesystem access⚙️ External commands🔑 Env variables🌐 Network access

Configure Azure PostgreSQL Passwordless Access

Teams need secure PostgreSQL access without shared passwords. This skill guides Entra ID setup, managed identities, group permissions, and migrations for Azure PostgreSQL.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "azure-postgres" from https://skillstore.io/skills/microsoft-azure-postgres.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-postgres/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-azure-postgres.md Signed manifest GET /api/skills/microsoft-azure-postgres/manifest Signed lockfile GET /api/skills/microsoft-azure-postgres/lockfile

Test it

Using "azure-postgres". Help me add a developer with read-only access.

Expected outcome:

Confirms the server, database, and Entra admin prerequisites.
Identifies the developer principal and creates the mapped PostgreSQL role.
Applies connect, schema usage, and table read permissions.
Gives a validation checklist for token-based connection testing.

Using "azure-postgres". Set up managed identity access for my web app.

Expected outcome:

Looks up the managed identity object and client identifiers.
Creates or reuses a PostgreSQL role for the service identity.
Grants only the requested database permission level.
Summarizes the connection settings the application needs.

Using "azure-postgres". Troubleshoot password authentication failed errors.

Expected outcome:

Checks token freshness, username format, and mapped role existence.
Separates database permission problems from network or firewall failures.
Recommends follow-up checks for Entra admin and group sync state.

Security Audit

High Risk

v4 • 7/5/2026 Open versioned report

Most static findings are false positives caused by Markdown links, portal URL examples, code fences, and legitimate Azure CLI guidance. The skill includes shell scripts that run administrative Azure and PostgreSQL actions; the main confirmed issue is unsafe SQL construction from caller-provided names. No prompt-injection text or hidden exfiltration intent was found.

Files scanned

1,983

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/setup-user.sh:78-85 scripts/setup-user.sh:95-118 scripts/setup-group.sh:112-120 scripts/setup-group.sh:141-164 scripts/setup-managed-identity.sh:92-102 scripts/setup-managed-identity.sh:115-138

Unsafe SQL Construction in Administration Scripts

The helper scripts insert command-line values such as users, groups, identities, and database names directly into SQL statements. A malicious or malformed value could change SQL executed by an Entra administrator.

The cited lines concatenate or interpolate script parameters and Azure-derived names into SQL strings. These scripts run as an administrative database user, so SQL injection or identifier confusion has high impact.

Risk Factors

📁 Filesystem access (12)

references/entra-rbac-overview.md:55 references/entra-rbac-overview.md:67 references/entra-rbac-overview.md:85 references/entra-rbac-overview.md:102 references/entra-rbac-overview.md:130 references/entra-rbac-overview.md:167 scripts/migrate-to-entra.sh:72 scripts/setup-group.sh:42 scripts/setup-group.sh:113 scripts/setup-managed-identity.sh:93 scripts/setup-user.sh:79 SKILL.md:62

⚙️ External commands (69)

🔑 Env variables (3)

references/sdk/azure-identity-py.md:24 references/sdk/azure-postgres-ts.md:14 references/sdk/azure-postgres-ts.md:14

🌐 Network access (2)

SKILL.md:56 SKILL.md:62

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-azure-postgres/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-postgres/security.svg)](https://skillstore.io/skills/microsoft-azure-postgres?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-azure-postgres?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-postgres/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-postgres.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). azure-postgres security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/microsoft-azure-postgres/audits/4

BibTeX citation

@techreport{microsoft-microsoft-azure-postgres-2026,
  author = {microsoft},
  title = {azure-postgres security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/microsoft-azure-postgres/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-postgres security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/microsoft-azure-postgres/audits/4"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-postgres:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add Developer Database Access

Grant a developer read-only, read-write, or admin access through an Entra ID user account.

Connect Applications Without Secrets

Map a managed identity to a PostgreSQL role so an Azure app can connect without stored passwords.

Move Teams to Group-Based Access

Use Entra groups to manage PostgreSQL permissions and choose the right group sync mode.

Try These Prompts

Check Server Readiness

Help me check whether my Azure PostgreSQL Flexible Server is ready for Microsoft Entra ID authentication.

Grant User Access

Guide me through granting {user_upn} {permission_level} access to database {database_name} on server {server_name}.

Configure Managed Identity

Plan managed identity access for app identity {identity_name} to Azure PostgreSQL database {database_name} with least privilege.

Plan Password Migration

Create a staged migration plan from password authentication to Entra-only authentication for Azure PostgreSQL server {server_name}.

Best Practices

Test changes in a non-production database before changing production authentication mode.
Grant the smallest permission level needed for each user, group, or managed identity.
Review generated SQL and Azure commands before running scripts with administrator privileges.

Avoid

Do not pass untrusted names or database identifiers directly into the included scripts.
Do not grant azure_pg_admin to application identities without a documented requirement.
Do not disable password authentication until every migrated role has been tested with Entra ID.