Authors: Johannes Schuetzner, Software Engineer at Mercedes-Benz & Nacho Alonso Portillo, Principal Program Manager at Microsoft

When you think of Mercedes-Benz, you think of innovation, precision, and trust. But behind every iconic vehicle and digital experience is a relentless drive for security and operational excellence. At Mercedes-Benz R&D in Sindelfingen, Germany, Johannes Schuetzner and the team faced a challenge familiar to many PostgreSQL users: how to build a secure, scalable, and flexible database architecture in the cloud—without sacrificing agility or developer productivity.

This article shares insights from Mercedes-Benz about how Azure Database for PostgreSQL can be leveraged to enhance your security posture, streamline access management, and empower teams to innovate with confidence.

The Challenge: Security Without Compromise

“OK, let’s stop intrusions in their tracks,” Schuetzner began his POSETTE talk, setting the tone for a deep dive into network security and access management.

Many organizations need to protect sensitive data, ensure compliance, and enable secure collaboration across distributed teams. The typical priorities are clear:

• Encrypt data in transit and at rest
• Implement row-level security for granular access
• Integrate with Microsoft Defender for Cloud for threat protection
• Focus on network security and access management—where configuration can make the biggest impact

Building a Secure Network: Private vs. Public Access

Mercedes-Benz explored two fundamental ways to set up their network for Azure Database for PostgreSQL: private access and public access.

“With private access, your PostgreSQL server is integrated in a virtual network. With public access, it is accessible by everybody on the public internet,” explained Schuetzner.

Public Access:

• Public endpoint, resolvable via DNS
• Firewall rules control allowed IP ranges
• Vulnerable to external attacks; traffic travels over public internet

Private Access:

• Server injected into an Azure VNET
• Traffic travels securely over the Azure backbone
• Requires delegated subnet and private DNS
• VNET peering enables cross-region connectivity

“One big benefit of private access is that the network traffic travels over the Azure backbone, so not the public internet,” said Schuetzner. This ensures that sensitive data remain protected, even as applications scaled across regions. An Azure VNET is restricted to an Azure region though and peering them may be complex.

Embracing Flexibility: The Power of Private Endpoints

Last year, Azure introduced private endpoints for PostgreSQL, a significant milestone in Mercedes-Benz’s database connectivity strategy. It adds a network interface to the resource that can also be reached from other Azure regions. This provides the resources in the VNET associated with the private endpoint to connect to the Postgres server. The network traffic travels securely over the Azure backbone.

Private endpoints allow Mercedes-Benz to:

• Dynamically enable and disable public access during migrations
• Flexibly provision multiple endpoints for different VNETs and regions
• Have explicit control over the allowed network accesses
• Have in-built protection from data exfiltration
• Automate setup with Terraform and infrastructure-as-code

This flexibility can be crucial for supporting large architectures and migration scenarios, all while maintaining robust security.

Passwordless Authentication: Simplicity Meets Security

Managing database passwords is a pain point for every developer. Mercedes-Benz embraced Azure Entra Authentication (formerly Azure Active Directory) to enable passwordless connections. Passwordless connections do not rely on traditional passwords but are based on more secure authentication methods of Azure Entra. They require less administrational efforts and prevent security breaches.

Benefits include:

• Uniform user management across Azure resources
• Group-based access control
• Passwordless authentication for applications and CI/CD pipelines

For developers, this means less manual overhead and fewer risks of password leaks. “Once you have set it up, then Azure takes good care of all the details, you don’t have to manage your passwords anymore, also they cannot be leaked anymore accidentally because you don’t have a password,” Schuetzner emphasized.

Principle of Least Privilege: Granular Authorization

Mercedes-Benz appreciates the principle of least privilege, ensuring applications have only the permissions they need—nothing more.

By correlating managed identities with specific roles in PostgreSQL, teams can grant only necessary Data Manipulation Language (DML) permissions (select, insert, update), while restricting Data Definition Language (DDL) operations. This approach minimizes risk and simplifies compliance.

Operational Excellence: Automation and Troubleshooting

Automation is key to Mercedes-Benz’s success. Using Terraform and integrated in CI/CD pipelines, the team can provision identities, configure endpoints, and manage permissions—all as code.

For troubleshooting, tools like Azure Bastion enable secure, temporary access to the database for diagnostics, without exposing sensitive endpoints.

The Impact: Security, Agility, and Developer Empowerment

By leveraging Azure Database for PostgreSQL, Mercedes-Benz can achieve:

• Stronger security through private networking and passwordless authentication
• Flexible, scalable architecture for global operations
• Streamlined access management and compliance
• Empowered developers to focus on innovation, not infrastructure

Schuetzner concluded, “Private endpoints provide a new network opportunity for Postgres on Azure. There are additional costs, but it’s more flexible and more dynamic. Azure takes good care of all the details, so you don’t have to manage your passwords anymore. It’s basically the ultimate solution for password management.”

Mercedes-Benz’s story shows that with the right tools and mindset, you can build secure and scalable solutions on Azure Database for PostgreSQL. For more details, refer to the full POSETTE session.