STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must map the PKI-authenticated identity to an associated user account.

DISA Rule

SV-255336r961044_rule

Vulnerability Number

V-255336

Group Title

SRG-APP-000177-DB-000069

Rule Version

ASQL-00-008500

Severity

CAT II

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.

Weight

10

Fix Recommendation

To set the Azure Active Directory Administrator, use the following PowerShell command:

$LogicalServerName = "myServer"
Set-AzSqlServerActiveDirectoryAdministrator -ResourceGroupName "myResourceGroup" -ServerName $LogicalServerName -DisplayName "myAADIdentify"

Azure Active Directory Authentication can be enabled using either PowerShell or the Azure CLI.

To enable Azure Active Directory Authentication using PowerShell, use the commands below:

######
###### Sets the AAD Admin in the SQL Server using PowerShell ######
######
$LogicalServerName = "myServer"
$ResourceGroup = "myResourceGroup"
$DisplayName = "<AAD Principal>"
$ObjectId = "<GUID for AAD Principal>"

Set-AzSqlServerActiveDirectoryAdministrator `
-ResourceGroupName $ResourceGroup `
-ServerName $LogicalServerName `
-DisplayName $DisplayName `
-ObjectId$ObjectId

#Sets AD Admin Only
Get-AzSqlServer -ServerName $LogicalServerName `
| Enable-AzSqlServerActiveDirectoryOnlyAuthentication

To enable Azure Active Directory Authentication using the Azure CLI, use the commands below:

######
###### Sets the AAD Admin in the SQL Server using the Azure CLI ######
######
az sql server ad-admin create `
--resource-group $ResourceGroup
--server $LogicalServerName `
--display-name $DisplayName `
--object-id $ObjectId `

#Sets AD Admin Only
az sql server ad-only-auth enable `
--resource-group $ResourceGroup `
--name $LogicalServerName

https://docs.microsoft.com/en-us/cli/azure/sql/server/ad-only-auth?view=azure-cli-latest
https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell

Check Contents

To verify that Azure Active Directory is configured as the authentication type, use the following PowerShell commands:

$LogicalServerName = "myServer"
Get-AzSqlServer -ServerName $LogicalServerName | Get-AzSqlServerActiveDirectoryOnlyAuthentication

If AzureADOnlyAuthentication returns False, this is a finding.

Vulnerability Number

V-255336

Documentable

False

Rule Version

ASQL-00-008500

Severity Override Guidance

To verify that Azure Active Directory is configured as the authentication type, use the following PowerShell commands:

$LogicalServerName = "myServer"
Get-AzSqlServer -ServerName $LogicalServerName | Get-AzSqlServerActiveDirectoryOnlyAuthentication

If AzureADOnlyAuthentication returns False, this is a finding.

Check Content Reference

M

Target Key

5500