STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must enforce access restrictions associated with changes to the configuration of the database(s).

DISA Rule

SV-276235r1150008_rule

Vulnerability Number

V-276235

Group Title

SRG-APP-000380-DB-000360

Rule Version

MSQL-00-003100

Severity

CAT II

CCI(s)

• CCI-001813 - Enforce access restrictions using organization-defined mechanisms.

Weight

10

Fix Recommendation

Document and obtain approval for logins with privileged permissions and role memberships.

If necessary, use the ALTER ROLE and/or REVOKE commands to remove unauthorized privileged permissions and/or role memberships. Example script provided below:

ALTER ROLE ddladmin DROP MEMBER UnauthorizedUser;

REVOKE SELECT ON OBJECT::test.table FROM UnauthorizedUser;

Refer to: https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-role-transact-sql
https://docs.microsoft.com/en-us/sql/t-sql/statements/revoke-transact-sql

If necessary, in the Azure Portal, navigate to the Access Control pane for the Azure SQL Managed Instance to review and remove unauthorized privileged permissions and/or role memberships.

Refer to the documentation linked below:
https://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions-list
https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove

Check Contents

Execute the following query to obtain a listing of user databases whose owner is a member of a fixed server role and the corresponding roles:

SELECT
D.name AS database_name, SUSER_SNAME(D.owner_sid) AS owner_name,
FRM.is_fixed_role_member, B.fixed_role_memberships
FROM sys.databases D
OUTER APPLY (
SELECT MAX(fixed_role_member) AS is_fixed_role_member
FROM (
SELECT IS_SRVROLEMEMBER(R.name, SUSER_SNAME(D.owner_sid)) AS fixed_role_member
FROM sys.server_principals R
WHERE is_fixed_role = 1
) A
) FRM
OUTER APPLY (
SELECT STUFF((SELECT ', ' + R.name
FROM sys.server_principals R
JOIN sys.server_role_members RM ON R.principal_id = RM.role_principal_id
WHERE RM.member_principal_id = SUSER_ID(SUSER_SNAME(D.owner_sid))
AND r.is_fixed_role =1
FOR XML PATH(''), TYPE).value('text()[1]','nvarchar(max)'), 1, LEN(','), '') AS fixed_role_memberships
) B
WHERE D.database_id > 4
AND (FRM.is_fixed_role_member = 1
OR FRM.is_fixed_role_member IS NULL)
ORDER BY database_name

If any server roles are returned, but not documented and authorized, this is a finding.

Vulnerability Number

V-276235

Documentable

False

Rule Version

MSQL-00-003100

Severity Override Guidance

Execute the following query to obtain a listing of user databases whose owner is a member of a fixed server role and the corresponding roles:

SELECT
D.name AS database_name, SUSER_SNAME(D.owner_sid) AS owner_name,
FRM.is_fixed_role_member, B.fixed_role_memberships
FROM sys.databases D
OUTER APPLY (
SELECT MAX(fixed_role_member) AS is_fixed_role_member
FROM (
SELECT IS_SRVROLEMEMBER(R.name, SUSER_SNAME(D.owner_sid)) AS fixed_role_member
FROM sys.server_principals R
WHERE is_fixed_role = 1
) A
) FRM
OUTER APPLY (
SELECT STUFF((SELECT ', ' + R.name
FROM sys.server_principals R
JOIN sys.server_role_members RM ON R.principal_id = RM.role_principal_id
WHERE RM.member_principal_id = SUSER_ID(SUSER_SNAME(D.owner_sid))
AND r.is_fixed_role =1
FOR XML PATH(''), TYPE).value('text()[1]','nvarchar(max)'), 1, LEN(','), '') AS fixed_role_memberships
) B
WHERE D.database_id > 4
AND (FRM.is_fixed_role_member = 1
OR FRM.is_fixed_role_member IS NULL)
ORDER BY database_name

If any server roles are returned, but not documented and authorized, this is a finding.

Check Content Reference

M

Target Key

5711