STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must separate user functionality (including user interface services) from database management functionality.

DISA Rule

SV-276250r1150065_rule

Vulnerability Number

V-276250

Group Title

SRG-APP-000211-DB-000122

Rule Version

MSQL-00-008900

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.

Weight

10

Fix Recommendation

To remove an Azure RBAC role assignment, use the Remove-AzRoleAssignment PowerShell command. Example command:

$userPrincipalName =
'Fourth.Coffee@contoso.onmicrosoft.us'
$RoleDefinitionName = 'SQL Managed Instance Contributor'
$ResourceGroupName ='stigtestingrg'
$ResourceName ='fourthcoffeemi'
$userObjectId =(Get-AzAdUser -UserPrincipalName $userPrincipalName).Id
$ResourceID =(Get-AzSqlInstance -ResourceGroupName $ResourceGroupName -Name $ManagedInstanceName).Id

Remove-AzRoleAssignment -Scope $ResourceID -RoleDefinitionName $RoleDefinitionName -ObjectId $userObjectId

Check Contents

To validate Azure role-based access controls (RBAC) for a specific resource, use the PowerShell script below:

$ManagedInstanceName = '<ManagedInstanceName>'
$SqlMI = Get-AzSqlInstance -Name $ManagedInstanceName
Get-AzRoleAssignment -Scope $SqlMI.Id | Select-Object DisplayName,SignInName,RoleDefinitionName,ObjectType

If a user not assigned information system management responsibilities has membership in any of the following roles, this is a finding:

- SQL Managed Instance.
- Contributor.
- SQL Security Manager.
- SqlMI Migration Role.
- User Access Administrator.
- Owner.
- Reader.
- Role Based Access Control.
- Administrator.

Vulnerability Number

V-276250

Documentable

False

Rule Version

MSQL-00-008900

Severity Override Guidance

To validate Azure role-based access controls (RBAC) for a specific resource, use the PowerShell script below:

$ManagedInstanceName = '<ManagedInstanceName>'
$SqlMI = Get-AzSqlInstance -Name $ManagedInstanceName
Get-AzRoleAssignment -Scope $SqlMI.Id | Select-Object DisplayName,SignInName,RoleDefinitionName,ObjectType

If a user not assigned information system management responsibilities has membership in any of the following roles, this is a finding:

- SQL Managed Instance.
- Contributor.
- SQL Security Manager.
- SqlMI Migration Role.
- User Access Administrator.
- Owner.
- Reader.
- Role Based Access Control.
- Administrator.

Check Content Reference

M

Target Key

5711