STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must enforce approved authorizations for logical access to server information and system resources in accordance with applicable access control policies.

DISA Rule

SV-255302r1112451_rule

Vulnerability Number

V-255302

Group Title

SRG-APP-000033-DB-000084

Rule Version

ASQL-00-000200

Severity

CAT I

CCI(s)

CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).

Weight

Fix Recommendation

Use GRANT, REVOKE, DENY, ALTER SERVER ROLE … ADD MEMBER … and/or ALTER SERVER ROLE …. DROP MEMBER statements to add and remove permissions on server-level securables, bringing them in line with the documented requirements.

References:
Revoke:
https://docs.microsoft.com/en-us/sql/t-sql/statements/revoke-transact-sql?view=azuresqldb-current

Deny:
https://docs.microsoft.com/en-us/sql/t-sql/statements/deny-transact-sql?view=azuresqldb-current

DROP MEMBER:
https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-droprolemember-transact-sql?view=azuresqldb-current

Check Contents

Review the system documentation to determine the required levels of protection for securables in the database, by type of login.

Review the permissions actually in place on the server.

Execute the supplemental script, "ASQL-00-000200-SERVER.sql" to find permissions assigned.

If the actual permissions do not match the documented requirements, this is a finding.

Vulnerability Number

V-255302

Documentable

False

Rule Version

ASQL-00-000200

Severity Override Guidance

Check Content Reference

Target Key

5500