STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

The Azure SQL Managed Instance audit storage account must be configured to prohibit public access.

DISA Rule

SV-276245r1150051_rule

Vulnerability Number

V-276245

Group Title

SRG-APP-000142-DB-000094

Rule Version

MSQL-00-007600

Severity

CAT II

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Assign the approved policy to the audit storage account:

1. From the Azure Portal, click the audit storage account.
2. Click "Networking" under security.
3. Review the public network access option.
4. Check the box to "Disable" public network access.
5. Click "Save".

Review the audit storage account's NSG configuration for inbound and outbound rules to restrict access to specific ports and resources.

For more information about connection policies, refer to:
https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/connectivity-architecture-overview?view=azuresql&tabs=current

Check Contents

Azure SQL Managed Instance must only use approved firewall settings, including disabling public network access. This value is not allowed by default in Azure SQL Managed Instance and must be disabled if not otherwise documented and approved.

Obtain a list of all approved firewall settings from the database documentation.

Obtain the audit file location(s) by running the following SQL script:

SELECT name AS AuditName, log_file_path AS AuditPath FROM sys.server_file_audits

For each audit, the AuditPath column will show the Azure Storage location of the audit files.

Review the storage networking permissions for the audit:

1. From the Azure Portal, click the storage account.
2. Click "Networking" under Security.
3. Verify the public network endpoint option is set to disabled.

If the value is enabled and not specifically approved in the database documentation, this is a finding.

Verify Network Security Groups (NSGs) are configured to restrict access only to the resources that require access to the storage account.

If access is not restricted, this is a finding.

Vulnerability Number

V-276245

Documentable

False

Rule Version

MSQL-00-007600

Severity Override Guidance

Azure SQL Managed Instance must only use approved firewall settings, including disabling public network access. This value is not allowed by default in Azure SQL Managed Instance and must be disabled if not otherwise documented and approved.

Obtain a list of all approved firewall settings from the database documentation.

Obtain the audit file location(s) by running the following SQL script:

SELECT name AS AuditName, log_file_path AS AuditPath FROM sys.server_file_audits

For each audit, the AuditPath column will show the Azure Storage location of the audit files.

Review the storage networking permissions for the audit:

1. From the Azure Portal, click the storage account.
2. Click "Networking" under Security.
3. Verify the public network endpoint option is set to disabled.

If the value is enabled and not specifically approved in the database documentation, this is a finding.

Verify Network Security Groups (NSGs) are configured to restrict access only to the resources that require access to the storage account.

If access is not restricted, this is a finding.

Check Content Reference

M

Target Key

5711