STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must be able to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

DISA Rule

SV-255343r961392_rule

Vulnerability Number

V-255343

Group Title

SRG-APP-000357-DB-000316

Rule Version

ASQL-00-010900

Severity

CAT II

CCI(s)

• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.

Weight

10

Fix Recommendation

Review the Azure SQL Database Audit file configuration information.
https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#manage-auditing

There are multiple options for configuring where audit logs will be written. Logs can be written to an Azure Blob Storage with Azure storage account, to a Log Analytics workspace, or to Event Hub. Any combination of these options can be configured, and audit logs will be written to each.

When writing logs to an Azure Storage account, the default value for retention period is "0" (unlimited retention).

Check Contents

Refer to the online documentation for the Azure SQL Database Audit configuration or the online documentation for the PowerShell cmdlet Get-AzSQLServerAudit using the links provided below.

https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#manage-auditing

https://docs.microsoft.com/en-us/powershell/module/az.sql/get-azsqlserveraudit?view=azps-6.4.0

Use the following PowerShell script to check for the proper configuration settings:

$FormatEnumerationLimit=-1
Get-AzSqlServerAudit -ResourceGroupName "Resource Group Name" -ServerName "Azure SQL Server Name" | Format-List -Property ServerName, *TargetState

If the BlobStorageTargetState, EventHubTargetState, or LogAnalyticsTargetState is disabled, this is a finding.

Vulnerability Number

V-255343

Documentable

False

Rule Version

ASQL-00-010900

Severity Override Guidance

Refer to the online documentation for the Azure SQL Database Audit configuration or the online documentation for the PowerShell cmdlet Get-AzSQLServerAudit using the links provided below.

https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#manage-auditing

https://docs.microsoft.com/en-us/powershell/module/az.sql/get-azsqlserveraudit?view=azps-6.4.0

Use the following PowerShell script to check for the proper configuration settings:

$FormatEnumerationLimit=-1
Get-AzSqlServerAudit -ResourceGroupName "Resource Group Name" -ServerName "Azure SQL Server Name" | Format-List -Property ServerName, *TargetState

If the BlobStorageTargetState, EventHubTargetState, or LogAnalyticsTargetState is disabled, this is a finding.

Check Content Reference

M

Target Key

5500