This page describes how built-in authentication works on Cloud SQL instances.

## Introduction

Authentication is the process of verifying the identity of a user who is
attempting to access an instance. Cloud SQL uses the following types of
authentication for database users:

- The database's built-in authentication uses a username and a password to authenticate local database users. For more information, see the following resources:
  - [Create and manage users](https://docs.cloud.google.com/sql/docs/sqlserver/create-manage-users.md.txt)
  - [About SQL Server users](https://docs.cloud.google.com/sql/docs/sqlserver/users.md.txt)
- [Authentication using Managed Service for Microsoft Active Directory](https://docs.cloud.google.com/sql/docs/sqlserver/ad.md.txt).
- [Authentication using customer-managed Microsoft AD](https://docs.cloud.google.com/sql/docs/sqlserver/cmad.md.txt).
- [Authentication using Microsoft Entra ID](https://docs.cloud.google.com/sql/docs/sqlserver/integration-with-microsoft-entra-id.md.txt).

Although Active Directory or Microsoft Entra ID authentication can be more secure
and reliable, you might prefer to use built-in authentication or a hybrid
authentication model that includes different authentication types.

## Limitations

- Cloud SQL for SQL Server doesn't support the following capabilities:
  - Custom password policies
  - IAM database authentication
  - IAM authentication for database operations
- Cloud SQL for SQL Serversupports IAM authentication for instance and backup operations only. For more information, see [IAM authentication](https://docs.cloud.google.com/sql/docs/sqlserver/iam-authentication.md.txt).

## What's next

- [Create an instance and set the password policy](https://docs.cloud.google.com/sql/docs/sqlserver/create-instance.md.txt).
- [Create users with built-in authentication](https://docs.cloud.google.com/sql/docs/sqlserver/create-manage-users.md.txt).