STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Server Managed Instance contained databases must use Microsoft Entra or native Windows principals.

DISA Rule

SV-276304r1149821_rule

Vulnerability Number

V-276304

Group Title

SRG-APP-000164-DB-000401

Rule Version

MSQL-D0-008000

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure Azure SQL Managed Instance contained databases to have users originating from Microsoft Entra (Azure Active Directory) principals. Remove any users not created from Microsoft Entra principals.

Reference Microsoft Entra Authentication: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-overview?view=azuresql-mi

Reference Contained Databases: https://learn.microsoft.com/en-us/sql/relational-databases/databases/contained-databases?view=azuresqldb-mi-current

Check Contents

Execute the following query to determine if Contained Databases are used:

SELECT * FROM sys.databases WHERE containment = 1

If any records are returned. Check the server documentation for a list of authorized contained database users.

Execute the following query to ensure contained database users are not using SQL Authentication:

EXEC sp_MSforeachdb 'USE [?];
SELECT DB_NAME() AS DatabaseName, *
FROM sys.database_principals dp
inner join sys.databases d on d.name = dp.name
WHERE dp.authentication_type = 2
and d.containment = 1'

If any records are returned, this is a finding.

Vulnerability Number

V-276304

Documentable

False

Rule Version

MSQL-D0-008000

Severity Override Guidance

Execute the following query to determine if Contained Databases are used:

SELECT * FROM sys.databases WHERE containment = 1

If any records are returned. Check the server documentation for a list of authorized contained database users.

Execute the following query to ensure contained database users are not using SQL Authentication:

EXEC sp_MSforeachdb 'USE [?];
SELECT DB_NAME() AS DatabaseName, *
FROM sys.database_principals dp
inner join sys.databases d on d.name = dp.name
WHERE dp.authentication_type = 2
and d.containment = 1'

If any records are returned, this is a finding.

Check Content Reference

M

Target Key

5711