STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

Contained databases must use Windows principals.

DISA Rule

SV-271306r1109119_rule

Vulnerability Number

V-271306

Group Title

SRG-APP-000164-DB-000401

Rule Version

SQLI-22-008000

Severity

CAT I

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

Configure SQL Server contained databases to have users originating from Microsoft Entra (Azure Active Directory) principals. Remove any users not created from Microsoft Entra principals.

Reference Contained Databases: https://learn.microsoft.com/en-us/sql/relational-databases/databases/contained-databases?

Check Contents

Execute the following query to determine if Contained Databases are used:

SELECT * FROM sys.databases WHERE containment = 1

If any records are returned, check the server documentation for a list of authorized contained database users.

Execute the following query to ensure contained database users are not using SQL Authentication:

EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, *
FROM sys.database_principals dp
inner join sys.databases d on d.name = dp.name
WHERE dp.authentication_type = 2
and d.containment = 1'

If any records are returned, this is a finding.

Vulnerability Number

V-271306

Documentable

False

Rule Version

SQLI-22-008000

Severity Override Guidance

Execute the following query to determine if Contained Databases are used:

SELECT * FROM sys.databases WHERE containment = 1

If any records are returned, check the server documentation for a list of authorized contained database users.

Execute the following query to ensure contained database users are not using SQL Authentication:

EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, *
FROM sys.database_principals dp
inner join sys.databases d on d.name = dp.name
WHERE dp.authentication_type = 2
and d.containment = 1'

If any records are returned, this is a finding.

Check Content Reference

M

Target Key

5677