STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure Resource Manager must enforce access restrictions associated with changes to the configuration of Azure SQL Managed Instance.

DISA Rule

SV-276309r1149836_rule

Vulnerability Number

V-276309

Group Title

SRG-APP-000380-DB-000360

Rule Version

MSQL-D0-011500

Severity

CAT II

CCI(s)

• CCI-001813 - Enforce access restrictions using organization-defined mechanisms.

Weight

10

Fix Recommendation

Remove accounts from the Administrators role that are not authorized.

Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

Check Contents

Obtain a list of accounts who have privileged access to the server via the Administrators role. For Control Plane Role Memberships, run this script in PowerShell:

$ManagedInstanceName = '<ManagedInstanceName>'
$SqlMI = Get-AzSqlInstance -Name $ManagedInstanceName
Get-AzRoleAssignment -Scope $SqlMI.Id | Select-Object DisplayName,SignInName,RoleDefinitionName,ObjectType

Check the documentation to verify the accounts and roles returned are authorized. If the accounts and roles are not documented and authorized, this is a finding.

Vulnerability Number

V-276309

Documentable

False

Rule Version

MSQL-D0-011500

Severity Override Guidance

Obtain a list of accounts who have privileged access to the server via the Administrators role. For Control Plane Role Memberships, run this script in PowerShell:

$ManagedInstanceName = '<ManagedInstanceName>'
$SqlMI = Get-AzSqlInstance -Name $ManagedInstanceName
Get-AzRoleAssignment -Scope $SqlMI.Id | Select-Object DisplayName,SignInName,RoleDefinitionName,ObjectType

Check the documentation to verify the accounts and roles returned are authorized. If the accounts and roles are not documented and authorized, this is a finding.

Check Content Reference

M

Target Key

5711