STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

The role(s)/group(s) used to modify database structure and logic modules inside Azure SQL Server Managed Instance must be restricted to authorized users.

DISA Rule

SV-276228r1149593_rule

Vulnerability Number

V-276228

Group Title

SRG-APP-000133-DB-000362

Rule Version

MSQL-00-001400

Severity

CAT II

CCI(s)

• CCI-001499 - Limit privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Document and obtain approval for any nonadministrative user(s) who require the ability to modify database structure and logic modules.

If necessary, use the ALTER ROLE and/or REVOKE commands to remove unauthorized users access to modify database structure. Examples provided below:

ALTER ROLE ddladmin DROP MEMBER UnauthorizedUser;

REVOKE SELECT ON OBJECT::test.table FROM UnauthorizedUser;

Refer to: https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-role-transact-sql?view=azuresqldb-mi-current

Check Contents

Obtain a listing of users and roles who are authorized to modify database structure and logic modules from the server documentation.

Execute the following query to obtain a list of database principals:

SELECT
P.type_desc AS principal_type,
P.name AS principal_name,
CASE DP.class
WHEN 0 THEN DP.class_desc
ELSE O.type_desc
END AS type_desc,CASE DP.class
WHEN 0 THEN DB_NAME()
WHEN 1 THEN OBJECT_SCHEMA_NAME(DP.major_id) + '.' + OBJECT_NAME(DP.major_id)
WHEN 3 THEN SCHEMA_NAME(DP.major_id)
ELSE DP.class_desc + '(' + CAST(DP.major_id AS nvarchar) + ')'
END AS securable_name,
DP.state_desc,
DP.permission_name
FROM sys.database_permissions DP
JOIN sys.database_principals P ON DP.grantee_principal_id = P.principal_id
LEFT OUTER JOIN sys.all_objects O ON O.object_id = DP.major_id AND O.type IN ('TR','TA','P','X','RF','PC','IF','FN','TF','U')
WHERE DP.type IN ('AL','ALTG') AND DP.class IN (0, 1, 53);
GO

Execute the following query to obtain a list of role memberships:

SELECT R.name AS role_name, M.type_desc AS principal_type, M.name AS principal_name
FROM sys.database_principals R
JOIN sys.database_role_members DRM ON R.principal_id = DRM.role_principal_id
JOIN sys.database_principals M ON DRM.member_principal_id = M.principal_id
WHERE R.name IN ('db_ddladmin','db_owner')
AND M.name <> 'dbo';
GO

If unauthorized access to the principal(s)/role(s) has been granted, this is a finding.

Vulnerability Number

V-276228

Documentable

False

Rule Version

MSQL-00-001400

Severity Override Guidance

Obtain a listing of users and roles who are authorized to modify database structure and logic modules from the server documentation.

Execute the following query to obtain a list of database principals:

SELECT
P.type_desc AS principal_type,
P.name AS principal_name,
CASE DP.class
WHEN 0 THEN DP.class_desc
ELSE O.type_desc
END AS type_desc,CASE DP.class
WHEN 0 THEN DB_NAME()
WHEN 1 THEN OBJECT_SCHEMA_NAME(DP.major_id) + '.' + OBJECT_NAME(DP.major_id)
WHEN 3 THEN SCHEMA_NAME(DP.major_id)
ELSE DP.class_desc + '(' + CAST(DP.major_id AS nvarchar) + ')'
END AS securable_name,
DP.state_desc,
DP.permission_name
FROM sys.database_permissions DP
JOIN sys.database_principals P ON DP.grantee_principal_id = P.principal_id
LEFT OUTER JOIN sys.all_objects O ON O.object_id = DP.major_id AND O.type IN ('TR','TA','P','X','RF','PC','IF','FN','TF','U')
WHERE DP.type IN ('AL','ALTG') AND DP.class IN (0, 1, 53);
GO

Execute the following query to obtain a list of role memberships:

SELECT R.name AS role_name, M.type_desc AS principal_type, M.name AS principal_name
FROM sys.database_principals R
JOIN sys.database_role_members DRM ON R.principal_id = DRM.role_principal_id
JOIN sys.database_principals M ON DRM.member_principal_id = M.principal_id
WHERE R.name IN ('db_ddladmin','db_owner')
AND M.name <> 'dbo';
GO

If unauthorized access to the principal(s)/role(s) has been granted, this is a finding.

Check Content Reference

M

Target Key

5711