STIGQter STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

The audit information produced by Azure SQL Managed Instance must be protected from unauthorized access.

DISA Rule

SV-276298r1150102_rule

Vulnerability Number

V-276298

Group Title

SRG-APP-000118-DB-000059

Rule Version

MSQL-D0-005900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Modify storage permissions to meet the requirement to protect against unauthorized access.

To review the storage configuration, navigate to the Azure Portal and review the audit storage configuration.

1. Navigate to the audit storage account then select "Containers" under the Data Storage heading.
2. Select the Audit Container name from the query result.
3. Scroll to the Settings heading on the left-side menu and select "Configuration".
- Set "Secure transfer required" to Enabled.
- Set "Allow Blob anonymous access" to Disabled.
- Set "Allow storage account key access" to Disabled.
- Set "Allow recommended upper limit for shared access signature (SAS) expiry interval" to an organizationally defined limit.
- Set "Minimum TLS version" to the latest available version that is supported by the application.

Check Contents

To obtain the Azure SQL Managed Instance audit file location(s), connect to the Azure SQL Managed Instance in SSMS and run the following query:

SELECT
[AuditStorageAccount] = SUBSTRING(audit_file_path, CHARINDEX('://', audit_file_path ) + 3, CHARINDEX('.', audit_file_path ) - CHARINDEX('://', audit_file_path ) - 3)
,[AuditContainer] = SUBSTRING(audit_file_path, CHARINDEX('/', audit_file_path, CHARINDEX('//', audit_file_path) + 2) + 1, CHARINDEX('/', audit_file_path, CHARINDEX('/', audit_file_path, CHARINDEX('//', audit_file_path) + 2) + 1) - CHARINDEX('/', audit_file_path, CHARINDEX('//',audit_file_path) + 2) - 1)
FROM sys.dm_server_audit_status
WHERE audit_file_path IS NOT NULL

The result will display the name of the storage account where the audit data is stored and the audit container.

Review the storage settings for the audit.

Verify that the audit storage has the correct permissions by doing the following:

1. Navigate to the audit storage account then select "Containers" under the Data Storage heading.
2. Select the Audit Container name from the query result.
3. Scroll to the Settings heading on the left-side menu and select "Configuration".
4. Verify the following settings:
- "Secure transfer required" must be Enabled.
- "Allow Blob anonymous access" must be Disabled.
- "Allow storage account key access" must be Disabled.
- "Allow recommended upper limit for shared access signature (SAS) expiry interval" must have an organizationally defined limit.
- "Minimum TLS version" must be set to the latest available version that is supported by the application.

Any settings that do not match the above requirements must be approved and documented, if not, this is a finding.

Vulnerability Number

V-276298

Documentable

False

Rule Version

MSQL-D0-005900

Severity Override Guidance

To obtain the Azure SQL Managed Instance audit file location(s), connect to the Azure SQL Managed Instance in SSMS and run the following query:

SELECT
[AuditStorageAccount] = SUBSTRING(audit_file_path, CHARINDEX('://', audit_file_path ) + 3, CHARINDEX('.', audit_file_path ) - CHARINDEX('://', audit_file_path ) - 3)
,[AuditContainer] = SUBSTRING(audit_file_path, CHARINDEX('/', audit_file_path, CHARINDEX('//', audit_file_path) + 2) + 1, CHARINDEX('/', audit_file_path, CHARINDEX('/', audit_file_path, CHARINDEX('//', audit_file_path) + 2) + 1) - CHARINDEX('/', audit_file_path, CHARINDEX('//',audit_file_path) + 2) - 1)
FROM sys.dm_server_audit_status
WHERE audit_file_path IS NOT NULL

The result will display the name of the storage account where the audit data is stored and the audit container.

Review the storage settings for the audit.

Verify that the audit storage has the correct permissions by doing the following:

1. Navigate to the audit storage account then select "Containers" under the Data Storage heading.
2. Select the Audit Container name from the query result.
3. Scroll to the Settings heading on the left-side menu and select "Configuration".
4. Verify the following settings:
- "Secure transfer required" must be Enabled.
- "Allow Blob anonymous access" must be Disabled.
- "Allow storage account key access" must be Disabled.
- "Allow recommended upper limit for shared access signature (SAS) expiry interval" must have an organizationally defined limit.
- "Minimum TLS version" must be set to the latest available version that is supported by the application.

Any settings that do not match the above requirements must be approved and documented, if not, this is a finding.

Check Content Reference

M

Target Key

5711