STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must only use approved firewall settings deemed by the organization to be secure, including denying azure services access to the server.

DISA Rule

SV-255347r961470_rule

Vulnerability Number

V-255347

Group Title

SRG-APP-000383-DB-000364

Rule Version

ASQL-00-011950

Severity

CAT II

CCI(s)

• CCI-001762 - Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.

Weight

10

Fix Recommendation

Assign the approved policy to Azure SQL Database.
1. From the Azure Portal Dashboard, click "Set Server Firewall".
2. Review the Allow Azure services and resources to access this server option.
3. Uncheck the box to "Deny Azure" services and resources to access this server.
4. Click "Save".

For more information about connection policies:
https://docs.microsoft.com/en-us/azure/azure-sql/database/connectivity-architecture

Check Contents

Azure SQL Database must only use approved firewall settings, including denying access to azure services and resources to the server. This option is denied by default in Azure SQL Database and should be left disabled if not otherwise documented and approved.

Obtain a list of approved firewall settings from the database documentation.

Verify that the "Allow Azure services and resources to access this server" option is disabled.
1. From the Azure Portal, navigate to the Azure SQL Database Dashboard.
2. Select "Set Server Firewall" on the top menu.
3. Under "Exceptions", review the "Allow Azure services and resources to access this server" option and verify that the value is not checked.

If the "Allow Azure services and resources to access this server" option is enabled, it must be necessary and specifically approved in the database documentation, otherwise this is a finding.

Vulnerability Number

V-255347

Documentable

False

Rule Version

ASQL-00-011950

Severity Override Guidance

Azure SQL Database must only use approved firewall settings, including denying access to azure services and resources to the server. This option is denied by default in Azure SQL Database and should be left disabled if not otherwise documented and approved.

Obtain a list of approved firewall settings from the database documentation.

Verify that the "Allow Azure services and resources to access this server" option is disabled.
1. From the Azure Portal, navigate to the Azure SQL Database Dashboard.
2. Select "Set Server Firewall" on the top menu.
3. Under "Exceptions", review the "Allow Azure services and resources to access this server" option and verify that the value is not checked.

If the "Allow Azure services and resources to access this server" option is enabled, it must be necessary and specifically approved in the database documentation, otherwise this is a finding.

Check Content Reference

M

Target Key

5500