STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must use NSA-approved cryptography to protect classified information in accordance with the data owners' requirements.

DISA Rule

SV-276236r1150044_rule

Vulnerability Number

V-276236

Group Title

SRG-APP-000416-DB-000380

Rule Version

MSQL-00-003200

Severity

CAT I

CCI(s)

• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

Create a compliant key/certificate and enable encryption on the database.

Refer to: https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-configure?view=azuresql&tabs=azure-powershell

Then execute the following command:
ALTER DATABASE [Database Name Between Brackets] SET ENCRYPTION ON;

Check Contents

Use the TSQL query below to determine database encryption state:

SELECT DB_NAME(database_id) AS DatabaseName, encryption_state_desc AS EncryptionState, key_algorithm+CAST(key_length AS nvarchar(128)) AS EncryptionAlgorithm, encryptor_type FROM sys.dm_database_encryption_keys

Validate that for each database the [EncryptionState] is "ENCRYPTED" and the [EncryptionAlgorithm] returns one of the following values: [AES128], [AES192], or [AES256].

If any other value is returned for either the "EncryptionState" or "EncryptionAlgorithm", this is a finding.

Vulnerability Number

V-276236

Documentable

False

Rule Version

MSQL-00-003200

Severity Override Guidance

Use the TSQL query below to determine database encryption state:

SELECT DB_NAME(database_id) AS DatabaseName, encryption_state_desc AS EncryptionState, key_algorithm+CAST(key_length AS nvarchar(128)) AS EncryptionAlgorithm, encryptor_type FROM sys.dm_database_encryption_keys

Validate that for each database the [EncryptionState] is "ENCRYPTED" and the [EncryptionAlgorithm] returns one of the following values: [AES128], [AES192], or [AES256].

If any other value is returned for either the "EncryptionState" or "EncryptionAlgorithm", this is a finding.

Check Content Reference

M

Target Key

5711