STIGQter STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA), and database administrator (DBA).

DISA Rule

SV-276306r1150025_rule

Vulnerability Number

V-276306

Group Title

SRG-APP-000267-DB-000163

Rule Version

MSQL-D0-010100

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by Azure SQL Managed Instance, for review by authorized personnel.

If any nonauthorized users have access to the Azure SQL Managed Instance Error Log in SQL Server Management Studio. Use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles.

Check Contents

Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices.

Azure SQL Managed Instance generates certain system events and user-defined events to the Azure SQL Managed Instance error log. The Azure SQL Managed Instance error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script:

USE master
GO
SELECT Name
FROM syslogins
WHERE (sysadmin = 1 or securityadmin = 1)
and hasaccess = 1;

If any nonauthorized users have access to the Azure SQL Managed Instance Error Log in SQL Server Management Studio, this is a finding.

Vulnerability Number

V-276306

Documentable

False

Rule Version

MSQL-D0-010100

Severity Override Guidance

Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices.

Azure SQL Managed Instance generates certain system events and user-defined events to the Azure SQL Managed Instance error log. The Azure SQL Managed Instance error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script:

USE master
GO
SELECT Name
FROM syslogins
WHERE (sysadmin = 1 or securityadmin = 1)
and hasaccess = 1;

If any nonauthorized users have access to the Azure SQL Managed Instance Error Log in SQL Server Management Studio, this is a finding.

Check Content Reference

M

Target Key

5711