STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Server Managed Instance must, for password-based authentication, require immediate selection of a new password upon account recovery.

DISA Rule

SV-276276r1149737_rule

Vulnerability Number

V-276276

Group Title

SRG-APP-000855-DB-000240

Rule Version

MSQL-00-019500

Severity

CAT II

CCI(s)

• CCI-004063 - For password-based authentication, require immediate selection of a new password upon account recovery.

Weight

10

Fix Recommendation

Create documentation to ensure administrators select "User must change password at next login" when a SQL login password is reset.
OR
Enable Entra-only Authentication.

Refer to: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication-tutorial?view=azuresql&tabs=azure-powershell

Check Contents

Determine whether Azure SQL Managed Instance is configured to use Entra-only authentication.

Run this PowerShell command to determine whether Microsoft Entra-only authentication is enabled:
Get-AzSqlInstanceActiveDirectoryOnlyAuthentication -InstanceName <myinstance> -ResourceGroupName <myresource>

If "AzureADOnlyAuthentication" value is "True", this is not a finding.

OR

In a query interface such as the SSMS Transact-SQL editor, run the statement:

SELECT CASE SERVERPROPERTY('IsExternalAuthenticationOnly')
WHEN 1 THEN 'Entra-only Authentication'
WHEN 0 THEN 'Entra and SQL Server Authentication'
END as [Authentication Mode]

If "Entra-only Authentication" is returned, this is not a finding.

Otherwise, verify documentation exists requiring administrators to select "User must change password at next login" when a SQL login password has been reset.

If documentation does not exist requiring the selection of a new password upon administrator password reset, this is a finding.

Vulnerability Number

V-276276

Documentable

False

Rule Version

MSQL-00-019500

Severity Override Guidance

Determine whether Azure SQL Managed Instance is configured to use Entra-only authentication.

Run this PowerShell command to determine whether Microsoft Entra-only authentication is enabled:
Get-AzSqlInstanceActiveDirectoryOnlyAuthentication -InstanceName <myinstance> -ResourceGroupName <myresource>

If "AzureADOnlyAuthentication" value is "True", this is not a finding.

OR

In a query interface such as the SSMS Transact-SQL editor, run the statement:

SELECT CASE SERVERPROPERTY('IsExternalAuthenticationOnly')
WHEN 1 THEN 'Entra-only Authentication'
WHEN 0 THEN 'Entra and SQL Server Authentication'
END as [Authentication Mode]

If "Entra-only Authentication" is returned, this is not a finding.

Otherwise, verify documentation exists requiring administrators to select "User must change password at next login" when a SQL login password has been reset.

If documentation does not exist requiring the selection of a new password upon administrator password reset, this is a finding.

Check Content Reference

M

Target Key

5711