STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must offload audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.

DISA Rule

SV-255377r961860_rule

Vulnerability Number

V-255377

Group Title

SRG-APP-000515-DB-000318

Rule Version

ASQL-00-015900

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Enable immutable storage so that audit logs cannot be modified or deleted accidently.
https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-policy-configure-container-scope?tabs=azure-portal

To configure a time-based retention policy on a container with the Azure portal, follow these steps:

1. Navigate to the desired container.
2. Select "More" on the right, then select "Access policy".
3. In the Immutable blob storage section, select "Add policy".
4. In the Policy type field, select "Time-based retention", and specify the retention period in days.
5. To create a policy with container scope, do not check the box for "Enable" version-level immutability.
6. If desired, select "Allow additional protected appends" to enable writes to append blobs that are protected by an immutability policy.

PowerShell:
Set-AzRmStorageContainerImmutabilityPolicy -ResourceGroupName <resource-group> `
-StorageAccountName <storage-account> `
-ContainerName <container> `
-ImmutabilityPeriod 10

Alternatively, enable at least two types of audit storage for the Azure SQL Database.
In the Azure Portal, select "Auditing".
Check at least two of the available storage types and select "Save".

Check Contents

Review the system documentation for a description of how audit records are stored.

1. Review the Auditing link in the Azure Portal for the SQL Database. Ensure audit logs are written to more than one storage system. If not, navigate to the Storage Container where the audits are stored via the Portal.
2. Select "Containers".
3. Select the ellipsis on the container for the audit storage.
4. Select "Access Policy".

Verify that an Immutable Blob Storage policy has been added to the audit container. If Azure audit logs are written to only one storage system or immutable storage is not enabled, this is a finding.

Vulnerability Number

V-255377

Documentable

False

Rule Version

ASQL-00-015900

Severity Override Guidance

Review the system documentation for a description of how audit records are stored.

1. Review the Auditing link in the Azure Portal for the SQL Database. Ensure audit logs are written to more than one storage system. If not, navigate to the Storage Container where the audits are stored via the Portal.
2. Select "Containers".
3. Select the ellipsis on the container for the audit storage.
4. Select "Access Policy".

Verify that an Immutable Blob Storage policy has been added to the audit container. If Azure audit logs are written to only one storage system or immutable storage is not enabled, this is a finding.

Check Content Reference

M

Target Key

5500