STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75 percent of maximum audit record storage capacity.

DISA Rule

SV-276253r1150067_rule

Vulnerability Number

V-276253

Group Title

SRG-APP-000359-DB-000319

Rule Version

MSQL-00-011000

Severity

CAT II

CCI(s)

• CCI-001855 - Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.

Weight

10

Fix Recommendation

Utilize Alerts in Microsoft Azure Monitoring and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75 percent.

Refer to: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview

Check Contents

Azure SQL Managed Instance must provide notice upon audit storage reaching capacity.

Verify if an Azure Rule exists with the following command example:

$storageAcct = Get-AzStorageAccount -ResourceGroupName 'Name of RG for Audit Storage' -Name 'Audit Storage Account Name'
$metric = Get-AzMetricAlertRuleV2 | Where-Object TargetResourceId -eq $storageAcct.Id
$metric.Criteria

If no alert exists, this is a finding.

If the criteria does not match 75 percent or less than the maximum capacity of 5TB, this is a finding.

Vulnerability Number

V-276253

Documentable

False

Rule Version

MSQL-00-011000

Severity Override Guidance

Azure SQL Managed Instance must provide notice upon audit storage reaching capacity.

Verify if an Azure Rule exists with the following command example:

$storageAcct = Get-AzStorageAccount -ResourceGroupName 'Name of RG for Audit Storage' -Name 'Audit Storage Account Name'
$metric = Get-AzMetricAlertRuleV2 | Where-Object TargetResourceId -eq $storageAcct.Id
$metric.Criteria

If no alert exists, this is a finding.

If the criteria does not match 75 percent or less than the maximum capacity of 5TB, this is a finding.

Check Content Reference

M

Target Key

5711