STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.

DISA Rule

SV-255316r961317_rule

Vulnerability Number

V-255316

Group Title

SRG-APP-000328-DB-000301

Rule Version

ASQL-00-002800

Severity

CAT II

CCI(s)

CCI-002165 - Enforce organization-defined discretionary access control policies over defined subjects and objects.

Weight

Fix Recommendation

To correct object ownership:
Use the ALTER AUTHORIZATION ON::[Object Name] TO [Database principal] TSQL statement to correct object ownership. Full ALTER AUTHORIZATION command syntax is described in this document: ALTER AUTHORIZATION (Transact-SQL) - SQL Server | Microsoft Docs (https://docs.microsoft.com/en-us/sql/t-sql/statements/revoke-transact-sql?view=azuresqldb-current)

To remove unauthorized permissions:
Use the REVOKE [Permission name] ON [Object name] TO [Database principal] to remove unauthorized permissions from a database principal on an object. Full REVOKE command syntax is described in this document: REVOKE (Transact-SQL) - SQL Server | Microsoft Docs (https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-authorization-transact-sql?view=azuresqldb-current)

Check Contents

Review application or system documentation to identify the required DAC.

Review the security configuration of the database. If applicable, review the security configuration of the application(s) using the database.

If the DAC defined in the documentation is not implemented in the security configuration, this is a finding.

Validate database object ownership using the queries below:

View object ownership - All objects and schemas

SELECT object_id,
SCHEMA_NAME(schema_id) AS SchemaName,
[name] AS Securable,
USER_NAME(principal_id) AS ObjectOwner,
[type_desc] AS ObjectType
FROM sys.objects
WHERE is_ms_shipped = 0 AND principal_id IS NOT NULL
ORDER BY ObjectType, Securable, ObjectOwner

View object ownership - Specific object

DECLARE @ObjectName nvarchar(512)
SET @ObjectName = '' --Specify object name here
SELECT object_id,
SCHEMA_NAME(schema_id) AS SchemaName,
[name] AS Securable,
USER_NAME(principal_id) AS ObjectOwner,
[type_desc] AS ObjectType
FROM sys.objects
WHERE is_ms_shipped = 0 AND principal_id IS NOT NULL
AND [name] = @ObjectName
ORDER BY ObjectType, Securable, ObjectOwner

View object ownership - Specific schema

DECLARE @SchemaName nvarchar(512)
SET @SchemaName = '' --Specify schema name here
SELECT object_id,
SCHEMA_NAME(schema_id) AS SchemaName,
[name] AS Securable,
USER_NAME(principal_id) AS ObjectOwner,
[type_desc] AS ObjectType
FROM sys.objects
WHERE is_ms_shipped = 0 AND principal_id IS NOT NULL
AND SCHEMA_NAME(schema_id) = @SchemaName
ORDER BY ObjectType, Securable, ObjectOwner

Schemas not owned by the schema or [dbo]

SELECT [name] AS [SchemaName], USER_NAME(principal_id) AS [SchemaOwner]
FROM sys.schemas
WHERE schema_id != principal_id --exclude schemas owned by the schema
AND principal_id != 1 --exclude schema dbo

Database principals delegated the right to assign additional permissions

SELECT U.type_desc AS [PrincipalType],
U.name AS [Grantee],
DP.class_desc AS [SecurableType],
CASE DP.class
WHEN 0 THEN DB_NAME()
WHEN 1 THEN OBJECT_NAME(DP.major_id)
WHEN 3 THEN SCHEMA_NAME(DP.major_id)
ELSE CAST(DP.major_id AS nvarchar)
END AS [Securable],
permission_name AS [PermissionName],
state_desc AS [DelegatedRight]
FROM sys.database_permissions DP
JOIN sys.database_principals U ON DP.grantee_principal_id = U.principal_id
WHERE DP.state = 'W'
ORDER BY Grantee, SecurableType, Securable

If any of these rights are not documented and authorized, this is a finding.

Vulnerability Number

V-255316

Documentable

False

Rule Version

ASQL-00-002800

Severity Override Guidance

Check Content Reference

Target Key

5500