STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must separate user functionality (including user interface services) from database management functionality.

DISA Rule

SV-255338r961095_rule

Vulnerability Number

V-255338

Group Title

SRG-APP-000211-DB-000122

Rule Version

ASQL-00-008900

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.

Weight

10

Fix Recommendation

To remove an Azure RBAC role assignment, use Remove-AzRoleAssignment PowerShell command.

Example:
Remove-AzRoleAssignment `
-SignInName "myAADIdenity" `
-ResourceGroupName "myResourceGroup" `
-ResourceName "myServerName" `
-ResourceType "Microsoft.Sql/servers" `
-RoleDefinitionName "myRole" `

Check Contents

To validate Azure role-based access controls (RBAC) for a specific resource, use the PowerShell script below:

$LogicalServerName = "myServer"
$ResourceScope = Get-AzResource -name $LogicalServerName | Where-Object {$_.ResourceType -eq "Microsoft.Sql/servers"} | Select-Object -ExpandProperty ResourceID

Get-AzRoleAssignment | Where-Object {$_.Scope -eq $ResourceScope}

If a user not assigned information system management responsibilities has membership in any of the following roles, this is a finding:

##SQL DB Contributor
##SQL Security Manager
##SQL Server Contributor
##User Access Administrator
##Owner
##Contributor
##Reader

Vulnerability Number

V-255338

Documentable

False

Rule Version

ASQL-00-008900

Severity Override Guidance

To validate Azure role-based access controls (RBAC) for a specific resource, use the PowerShell script below:

$LogicalServerName = "myServer"
$ResourceScope = Get-AzResource -name $LogicalServerName | Where-Object {$_.ResourceType -eq "Microsoft.Sql/servers"} | Select-Object -ExpandProperty ResourceID

Get-AzRoleAssignment | Where-Object {$_.Scope -eq $ResourceScope}

If a user not assigned information system management responsibilities has membership in any of the following roles, this is a finding:

##SQL DB Contributor
##SQL Security Manager
##SQL Server Contributor
##User Access Administrator
##Owner
##Contributor
##Reader

Check Content Reference

M

Target Key

5500