![[Google Cloud Documentation]](https://www.gstatic.com/devrel-devsite/prod/v0f3a5b8b76e4a120372a69044e02756e703b6140f9f1812c6e4a0407b19864b7/clouddocs/images/lockup_full_color.svg){kind=link}
![[]](https://docs.cloud.google.com/_static/clouddocs/images/icons/products/sql-color.svg){kind=link}
This page describes how built-in authentication works on Cloud SQL instances.
Introduction
Authentication is the process of verifying the identity of a user who is attempting to access an instance. Cloud SQL uses the following types of authentication for database users:
- The database's built-in authentication uses a username and a password to authenticate local database users. For more information, see the following resources:
- Authentication using Managed Service for Microsoft Active Directory.
- Authentication using customer-managed Microsoft AD.
- Authentication using Microsoft Entra ID.
Although Active Directory or Microsoft Entra ID authentication can be more secure and reliable, you might prefer to use built-in authentication or a hybrid authentication model that includes different authentication types.
Limitations
- Cloud SQL for SQL Server doesn't support the following capabilities:
- Custom password policies
- IAM database authentication
- IAM authentication for database operations
- Cloud SQL for SQL Serversupports IAM authentication for instance and backup operations only. For more information, see IAM authentication.