STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

If passwords are used for authentication, Azure SQL Server Managed Instance must transmit only encrypted representations of passwords.

DISA Rule

SV-276305r1150105_rule

Vulnerability Number

V-276305

Group Title

SRG-APP-000172-DB-000075

Rule Version

MSQL-D0-008300

Severity

CAT I

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

Run the following PowerShell script to set the Azure SQL Managed Instance MinimalTLSversion to the latest available TLS version:

##This is an example script##
$ResourceGroup = '<resource group name here>'
$ManagedInstance = '<Azure SQL Managed Instance name here>'
$TLSmax = (Get-Command -Name set-azsqlinstance -ParameterName 'minimaltlsversion').parameters['minimaltlsversion'].attributes.where({$_ -is [ValidateSet] }).ValidValues | Select-Object -Last 1
Set-AzSqlInstance -ResourceGroupName $ResourceGroup -Name $ManagedInstance -MinimalTlsVersion $TLSmax

References: https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/minimal-tls-version-configure?view=azuresql-mi

Check Contents

Verify the MinimalTLSversion using the following PowerShell script:

$Subscription = 'SubscriptionValueHere'
$Environment = 'EnvironmentTypeHere'
Connect-AzAccount -Subscription $Subscription -Environment $Environment

$ResourceGroup = 'ResourceGroupHere'
$ManagedInstance = 'ManagedInstanceHere'
$TLSmax = (Get-Command -Name set-azsqlinstance -ParameterName 'minimaltlsversion').parameters['minimaltlsversion'].attributes.where({$_ -is [ValidateSet] }).ValidValues Select-Object -Last 1
$TLScur = (Get-AzSqlInstance -ResourceGroupName $ResourceGroup -Name $ManagedInstance).MinimalTlsVersion
Write-Host "Latest TLS Version : [$TlSMax]"
Write-Host "Current TLS Version : [$TLScur]"

Verify that the minimum TLS version property is set to the latest available TLS version. If a less secure TLS version is set and not documented as required by the supported application, this is a finding.

Vulnerability Number

V-276305

Documentable

False

Rule Version

MSQL-D0-008300

Severity Override Guidance

Verify the MinimalTLSversion using the following PowerShell script:

$Subscription = 'SubscriptionValueHere'
$Environment = 'EnvironmentTypeHere'
Connect-AzAccount -Subscription $Subscription -Environment $Environment

$ResourceGroup = 'ResourceGroupHere'
$ManagedInstance = 'ManagedInstanceHere'
$TLSmax = (Get-Command -Name set-azsqlinstance -ParameterName 'minimaltlsversion').parameters['minimaltlsversion'].attributes.where({$_ -is [ValidateSet] }).ValidValues Select-Object -Last 1
$TLScur = (Get-AzSqlInstance -ResourceGroupName $ResourceGroup -Name $ManagedInstance).MinimalTlsVersion
Write-Host "Latest TLS Version : [$TlSMax]"
Write-Host "Current TLS Version : [$TLScur]"

Verify that the minimum TLS version property is set to the latest available TLS version. If a less secure TLS version is set and not documented as required by the supported application, this is a finding.

Check Content Reference

M

Target Key

5711