STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must generate audit records for all privileged activities or other system-level access.

DISA Rule

SV-255370r961827_rule

Vulnerability Number

V-255370

Group Title

SRG-APP-000504-DB-000354

Rule Version

ASQL-00-014900

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Deploy an Azure SQL Database audit.

Refer to the supplemental file "AzureSQLDatabaseAudit.txt" PowerShell script.

Reference:
https://docs.microsoft.com/en-us/powershell/module/az.sql/set-azsqlserveraudit">https://docs.microsoft.com/en-us/powershell/module/az.sql/set-azsqlserveraudit

Check Contents

Review Azure SQL Database configuration to verify that audit records are produced for all privileged activities or other system-level access.

To determine if an audit is configured, execute the following script.
Run this TSQL command to determine if SQL Auditing AuditActionGroups are configured:
SELECT DISTINCT sd.audit_action_name
FROM sys.database_audit_specification_details sd
JOIN sys.database_audit_specifications s
ON s.database_specification_id = sd.database_specification_id
WHERE (name = 'SqlDbAuditing_ServerAuditSpec' /*Server Audit*/
OR name = 'SqlDbAuditing_AuditSpec') /*Database Audit*/
AND s.is_state_enabled = 1
ORDER BY sd.audit_action_name

If no values exist for AuditActionGroup, this is a finding.

Verify the following AuditActionGroup(s) are configured:
APPLICATION_ROLE_CHANGE_PASSWORD_GROUP
BACKUP_RESTORE_GROUP
DATABASE_CHANGE_GROUP
DATABASE_OBJECT_CHANGE_GROUP
DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP
DATABASE_OBJECT_PERMISSION_CHANGE_GROUP
DATABASE_OPERATION_GROUP
DATABASE_OWNERSHIP_CHANGE_GROUP
DATABASE_PERMISSION_CHANGE_GROUP
DATABASE_PRINCIPAL_CHANGE_GROUP
DATABASE_PRINCIPAL_IMPERSONATION_GROUP
DATABASE_ROLE_MEMBER_CHANGE_GROUP
DBCC_GROUP
SCHEMA_OBJECT_CHANGE_GROUP
SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP
SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP
USER_CHANGE_PASSWORD_GROUP

If any listed AuditActionGroups do not exist in the configuration, this is a finding.

Vulnerability Number

V-255370

Documentable

False

Rule Version

ASQL-00-014900

Severity Override Guidance

Review Azure SQL Database configuration to verify that audit records are produced for all privileged activities or other system-level access.

To determine if an audit is configured, execute the following script.
Run this TSQL command to determine if SQL Auditing AuditActionGroups are configured:
SELECT DISTINCT sd.audit_action_name
FROM sys.database_audit_specification_details sd
JOIN sys.database_audit_specifications s
ON s.database_specification_id = sd.database_specification_id
WHERE (name = 'SqlDbAuditing_ServerAuditSpec' /*Server Audit*/
OR name = 'SqlDbAuditing_AuditSpec') /*Database Audit*/
AND s.is_state_enabled = 1
ORDER BY sd.audit_action_name

If no values exist for AuditActionGroup, this is a finding.

Verify the following AuditActionGroup(s) are configured:
APPLICATION_ROLE_CHANGE_PASSWORD_GROUP
BACKUP_RESTORE_GROUP
DATABASE_CHANGE_GROUP
DATABASE_OBJECT_CHANGE_GROUP
DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP
DATABASE_OBJECT_PERMISSION_CHANGE_GROUP
DATABASE_OPERATION_GROUP
DATABASE_OWNERSHIP_CHANGE_GROUP
DATABASE_PERMISSION_CHANGE_GROUP
DATABASE_PRINCIPAL_CHANGE_GROUP
DATABASE_PRINCIPAL_IMPERSONATION_GROUP
DATABASE_ROLE_MEMBER_CHANGE_GROUP
DBCC_GROUP
SCHEMA_OBJECT_CHANGE_GROUP
SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP
SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP
USER_CHANGE_PASSWORD_GROUP

If any listed AuditActionGroups do not exist in the configuration, this is a finding.

Check Content Reference

M

Target Key

5500