diff --git a/exports.js b/exports.js
index d8150d0198..6b9efe0328 100644
--- a/exports.js
+++ b/exports.js
@@ -1191,6 +1191,7 @@ module.exports = {
 
         'batchAccountCmkEncrypted'      : require(__dirname + '/plugins/azure/batchAccounts/batchAccountCmkEncrypted.js'),
         'batchAccountDiagnosticLogs'    : require(__dirname + '/plugins/azure/batchAccounts/batchAccountDiagnosticLogs.js'),
+        'batchAccountsAADEnabled'       : require(__dirname + '/plugins/azure/batchAccounts/batchAccountsAADEnabled.js'),
         'batchAccountsHasTags'          : require(__dirname + '/plugins/azure/batchAccounts/batchAccountsHasTags.js'),
         'batchAccountsPublicAccess'     : require(__dirname + '/plugins/azure/batchAccounts/batchAccountsPublicAccess.js'),
 
diff --git a/plugins/azure/batchAccounts/batchAccountsAADEnabled.js b/plugins/azure/batchAccounts/batchAccountsAADEnabled.js
new file mode 100644
index 0000000000..cf9cabc3ad
--- /dev/null
+++ b/plugins/azure/batchAccounts/batchAccountsAADEnabled.js
@@ -0,0 +1,57 @@
+var async = require('async');
+var helpers = require('../../../helpers/azure/');
+
+module.exports = {
+    title: 'Batch Account AAD Auth Enabled',
+    category: 'Batch',
+    domain: 'Compute',
+    severity: 'Medium',
+    description: 'Ensures that Batch account has Azure Active Directory (AAD) authentication mode enabled.',
+    more_info: 'Enabling Azure Active Directory (AAD) authentication for Batch account ensures enhanced security by restricting the service API authentication to Microsoft Entra ID that prevents access through less secure shared key methods, thereby safeguarding batch resources from unauthorized access.',
+    recommended_action: 'Enable Active Directory authentication mode for all Batch accounts.',
+    link: 'https://learn.microsoft.com/en-us/azure/batch/batch-aad-auth',
+    apis: ['batchAccounts:list'],
+    realtime_triggers: ['microsoftbatch:batchaccounts:write', 'microsoftbatch:batchaccounts:delete'],
+
+    run: function(cache, settings, callback) {
+        var results = [];
+        var source = {};
+        var locations = helpers.locations(settings.govcloud);
+
+        async.each(locations.batchAccounts, function(location, rcb) {
+
+            var batchAccounts = helpers.addSource(cache, source,
+                ['batchAccounts', 'list', location]);
+
+            if (!batchAccounts) return rcb();
+
+            if (batchAccounts.err || !batchAccounts.data) {
+                helpers.addResult(results, 3, 'Unable to query for Batch accounts: ' + helpers.addError(batchAccounts), location);
+                return rcb();
+            }
+            if (!batchAccounts.data.length) {
+                helpers.addResult(results, 0, 'No existing Batch accounts found', location);
+                return rcb();
+            }
+
+            for (let batchAccount of batchAccounts.data) {
+                if (!batchAccount.id) continue;
+
+                let found = batchAccount.allowedAuthenticationModes && 
+                            batchAccount.allowedAuthenticationModes.length?
+                    batchAccount.allowedAuthenticationModes.some(mode => mode.toUpperCase() === 'AAD') : false;
+
+                if (found) {
+                    helpers.addResult(results, 0, 'Batch account has Active Directory authentication enabled', location, batchAccount.id);
+                } else {
+                    helpers.addResult(results, 2, 'Batch account does not have Active Directory authentication enabled', location, batchAccount.id);
+                }
+
+            }
+
+            rcb();
+        }, function() {
+            callback(null, results, source);
+        });
+    }
+};
\ No newline at end of file
diff --git a/plugins/azure/batchAccounts/batchAccountsAADEnabled.spec.js b/plugins/azure/batchAccounts/batchAccountsAADEnabled.spec.js
new file mode 100644
index 0000000000..cd106bc09f
--- /dev/null
+++ b/plugins/azure/batchAccounts/batchAccountsAADEnabled.spec.js
@@ -0,0 +1,94 @@
+
+var expect = require('chai').expect;
+var batchAccountsAADEnabled = require('./batchAccountsAADEnabled');
+
+const batchAccounts = [
+    {
+        "id": "/subscriptions/1234566/resourceGroups/dummy/providers/Microsoft.Batch/batchAccounts/test",
+        "name": "test",
+        "type": "Microsoft.Batch/batchAccounts",
+        "location": "eastus",
+        "accountEndpoint": "test.eastus.batch.azure.com",
+        "nodeManagementEndpoint": "123456789.eastus.service.batch.azure.com",
+        "allowedAuthenticationModes": ["SharedKey", "AAD", "TaskAuthenticationToken"]
+    },
+    {
+        "id": "/subscriptions/1234566/resourceGroups/dummy/providers/Microsoft.Batch/batchAccounts/test",
+        "name": "test",
+        "type": "Microsoft.Batch/batchAccounts",
+        "location": "eastus",
+        "accountEndpoint": "test.eastus.batch.azure.com",
+        "nodeManagementEndpoint": "123456789.eastus.service.batch.azure.com",
+    },
+];
+
+const createCache = (batchAccounts) => {
+    return {
+        batchAccounts: {
+            list: {
+                'eastus': {
+                    data: batchAccounts
+                }
+            }
+        }
+    }
+};
+
+const createErrorCache = () => {
+    return {
+        batchAccounts: {
+            list: {
+                'eastus': {}
+            }
+        }
+    };
+};
+
+describe('batchAccountsAADEnabled', function () {
+    describe('run', function () {
+
+        it('should give unknown result if unable to query for Batch accounts:', function (done) {
+            const cache = createCache(null);
+            batchAccountsAADEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(3);
+                expect(results[0].message).to.include('Unable to query for Batch accounts:');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give passing result if no Batch account exist', function (done) {
+            const cache = createCache([]);
+            batchAccountsAADEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('No existing Batch accounts found');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give passing result if Batch account is configured with AAD Authentication', function (done) {
+            const cache = createCache([batchAccounts[0]]);
+            batchAccountsAADEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('Batch account has Active Directory authentication enabled');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give failing result if Batch account is not configured with AAD Authentication', function (done) {
+            const cache = createCache([batchAccounts[1]]);
+            batchAccountsAADEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(2);
+                expect(results[0].message).to.include('Batch account does not have Active Directory authentication enabled');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+    });
+});
\ No newline at end of file