STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must map the PKI-authenticated identity to an associated user account.

DISA Rule

SV-276248r1150096_rule

Vulnerability Number

V-276248

Group Title

SRG-APP-000177-DB-000069

Rule Version

MSQL-00-008500

Severity

CAT II

CCI(s)

CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.

Weight

Fix Recommendation

To set the Entra ID Administrator, use the following PowerShell command:

Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Set-AzSqlInstanceActiveDirectoryAdministrator -DisplayName '<Entra Admin User/Group Name>'

To enable Entra ID only authentication, use the following PowerShell command:

Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Enable-AzSqlInstanceActiveDirectoryOnlyAuthentication

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?view=azuresql-mi&tabs=azure-powershell

Check Contents

Determine if Azure SQL Managed Instance is configured to use Microsoft Entra ID authentication only.

To verify Azure Active Directory is configured as the authentication type, use the following PowerShell commands:

Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Get-AzSqlInstanceActiveDirectoryOnlyAuthentication

If AzureADOnlyAuthentication returns "True", this is not a finding.

If AzureADOnlyAuthentication returns "False" and the need for mixed mode authentication has not been documented and approved, this is a finding.

Vulnerability Number

V-276248

Documentable

False

Rule Version

MSQL-00-008500

Severity Override Guidance

Check Content Reference

Target Key

5711