STIGQter STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

DISA Rule

SV-255337r961053_rule

Vulnerability Number

V-255337

Group Title

SRG-APP-000180-DB-000115

Rule Version

ASQL-00-008800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Ensure all logins are uniquely identifiable and authenticate all nonorganizational users who log onto the system. This likely would be done via a combination of Azure Active Directory with unique accounts and the Azure SQL Database by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.

Check Contents

Review documentation, Azure SQL Database settings, and authentication system settings to determine if nonorganizational users are individually identified and authenticated when logging onto the system.

If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to Azure SQL Database using a standard, shared account, ensure that it also captures the individual user identification and passes it to Azure SQL Database.

If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding.

If nonorganizational users are not uniquely identified and authenticated, this is a finding.

Vulnerability Number

V-255337

Documentable

False

Rule Version

ASQL-00-008800

Severity Override Guidance

Review documentation, Azure SQL Database settings, and authentication system settings to determine if nonorganizational users are individually identified and authenticated when logging onto the system.

If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to Azure SQL Database using a standard, shared account, ensure that it also captures the individual user identification and passes it to Azure SQL Database.

If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding.

If nonorganizational users are not uniquely identified and authenticated, this is a finding.

Check Content Reference

M

Target Key

5500