STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must have an audit defined to track Microsoft Support Operations.

DISA Rule

SV-276297r1150073_rule

Vulnerability Number

V-276297

Group Title

SRG-APP-000101-DB-000044

Rule Version

MSQL-D0-005500

Severity

CAT III

CCI(s)

• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.

Weight

10

Fix Recommendation

Create a new SQL Server Audit with the Microsoft support operations option enabled.

Adjust the following T-SQL Query for the environment and execute:

CREATE SERVER AUDIT [<Enter Name of Audit>] TO URL ( PATH = N'<URL for Blob Container>' ) WITH ( OPERATOR_AUDIT = ON ) GO
ALTER SERVER AUDIT [<Enter Name of Audit>] WITH (STATE = ON) GO

Alternatively, when using SQL Server Management Studio to create an audit, ensure the Microsoft support operations checkbox is flagged.

Check Contents

Review the system documentation to determine if the auditing of Microsoft support operations is required. If is documented as not required, this is Not Applicable.

If the system documentation requires the auditing of Microsoft Support operations, run the following query to determine whether an audit has been defined to capture Microsoft Support operations:

SELECT audit_id, name, is_state_enabled
FROM sys.server_audits
WHERE is_operator_audit = 1

If no audit is returned, this is a finding.

Vulnerability Number

V-276297

Documentable

False

Rule Version

MSQL-D0-005500

Severity Override Guidance

Review the system documentation to determine if the auditing of Microsoft support operations is required. If is documented as not required, this is Not Applicable.

If the system documentation requires the auditing of Microsoft Support operations, run the following query to determine whether an audit has been defined to capture Microsoft Support operations:

SELECT audit_id, name, is_state_enabled
FROM sys.server_audits
WHERE is_operator_audit = 1

If no audit is returned, this is a finding.

Check Content Reference

M

Target Key

5711