STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Access to linked servers must be disabled or restricted for Azure SQL Server Managed Instance, unless specifically required and approved.

DISA Rule

SV-276302r1149815_rule

Vulnerability Number

V-276302

Group Title

SRG-APP-000141-DB-000093

Rule Version

MSQL-D0-007500

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Disable use of or remove any linked servers that are not authorized.

To remove a linked server and all associated logins, execute the following:

EXEC sp_dropserver 'LinkedServerName', 'droplogins'.

To remove a login from a linked server, execute the following:

EXEC sp_droplinkedsrvlogin 'LoginName', NULL;

Check Contents

A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed.

To obtain a list of linked servers, execute the following command:

SELECT name
FROM sys.servers s
WHERE s.is_linked = 1

Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding.

Run the following to get a linked server login mapping:

SELECT s.name, p.principal_id, l.remote_name
FROM sys.servers s
JOIN sys.linked_logins l ON s.server_id = l.server_id
LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id
WHERE s.is_linked = 1

Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.

Vulnerability Number

V-276302

Documentable

False

Rule Version

MSQL-D0-007500

Severity Override Guidance

A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed.

To obtain a list of linked servers, execute the following command:

SELECT name
FROM sys.servers s
WHERE s.is_linked = 1

Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding.

Run the following to get a linked server login mapping:

SELECT s.name, p.principal_id, l.remote_name
FROM sys.servers s
JOIN sys.linked_logins l ON s.server_id = l.server_id
LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id
WHERE s.is_linked = 1

Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.

Check Content Reference

M

Target Key

5711