STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

DISA Rule

SV-255335r1051115_rule

Vulnerability Number

V-255335

Group Title

SRG-APP-000148-DB-000103

Rule Version

ASQL-00-007800

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Remove user-accessible shared accounts and use individual user IDs.

If necessary, use the DROP USER command to remove user-accessible shared accounts. Example provided below.

DROP USER SharedAccount;

https://docs.microsoft.com/en-us/sql/t-sql/statements/drop-user-transact-sql

Check Contents

Review Azure SQL Database users to determine whether shared accounts exist. (This does not include the case where Azure SQL Database has a guest or public account that is providing access to publicly available information.)

If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to Azure SQL Database using a standard, shared account, ensure it also captures the individual user identification and passes it to Azure SQL Database.

If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.

If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.

Vulnerability Number

V-255335

Documentable

False

Rule Version

ASQL-00-007800

Severity Override Guidance

Review Azure SQL Database users to determine whether shared accounts exist. (This does not include the case where Azure SQL Database has a guest or public account that is providing access to publicly available information.)

If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to Azure SQL Database using a standard, shared account, ensure it also captures the individual user identification and passes it to Azure SQL Database.

If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.

If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.

Check Content Reference

M

Target Key

5500