STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

DISA Rule

SV-276247r1150045_rule

Vulnerability Number

V-276247

Group Title

SRG-APP-000148-DB-000103

Rule Version

MSQL-00-007800

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Remove user-accessible shared accounts and use individual user IDs.

If necessary, use the DROP USER command to remove user-accessible shared accounts. Example provided below.

DROP USER [SharedAccount];

Check Contents

Review Azure SQL Managed Instance users to determine whether shared accounts exist. (This does not include the case where Azure SQL Managed Instance has a guest or public account that is providing access to publicly available information.)

If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to Azure SQL Managed Instance using a standard, shared account, ensure it also captures the individual user identification and passes it to Azure SQL Managed Instance.

If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.

If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.

Vulnerability Number

V-276247

Documentable

False

Rule Version

MSQL-00-007800

Severity Override Guidance

Review Azure SQL Managed Instance users to determine whether shared accounts exist. (This does not include the case where Azure SQL Managed Instance has a guest or public account that is providing access to publicly available information.)

If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to Azure SQL Managed Instance using a standard, shared account, ensure it also captures the individual user identification and passes it to Azure SQL Managed Instance.

If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.

If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.

Check Content Reference

M

Target Key

5711