STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Azure SQL Database must be configured to generate audit records for DOD-defined auditable events within all DBMS/database components.

DISA Rule

SV-255324r960879_rule

Vulnerability Number

V-255324

Group Title

SRG-APP-000089-DB-000064

Rule Version

ASQL-00-004300

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

Weight

10

Fix Recommendation

Deploy an Azure SQL Database audit.

Refer to the supplemental file "AzureSQLDatabaseAudit.txt" PowerShell script.

Check Contents

Check Azure SQL Database to see if an auditing is enabled.

Execute the following steps:
1. In the Azure Portal, open a Cloud Shell session.
2. Run this PowerShell command to determine if SQL Auditing is enabled:

$ResourceGroup = "myResourceGroup"
$ServerName = "myServerName"
Get-AzSqlServerAudit -ResourceGroupName $ResourceGroup -ServerName $ServerName `
| Select-object -property BlobStorageTargetState,LogAnalyticsTargetState,EventHubTargetState

If BlobStorageTargetState, LogAnalyticsTargetState and EventHubTargetState (all three) are Disabled, this is a finding.

Vulnerability Number

V-255324

Documentable

False

Rule Version

ASQL-00-004300

Severity Override Guidance

Check Azure SQL Database to see if an auditing is enabled.

Execute the following steps:
1. In the Azure Portal, open a Cloud Shell session.
2. Run this PowerShell command to determine if SQL Auditing is enabled:

$ResourceGroup = "myResourceGroup"
$ServerName = "myServerName"
Get-AzSqlServerAudit -ResourceGroupName $ResourceGroup -ServerName $ServerName `
| Select-object -property BlobStorageTargetState,LogAnalyticsTargetState,EventHubTargetState

If BlobStorageTargetState, LogAnalyticsTargetState and EventHubTargetState (all three) are Disabled, this is a finding.

Check Content Reference

M

Target Key

5500