STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance must generate audit records when attempts to access categorized information (e.g., classification levels/security levels) occur.

DISA Rule

SV-276313r1149848_rule

Vulnerability Number

V-276313

Group Title

SRG-APP-000494-DB-000345

Rule Version

MSQL-D0-013200

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Deploy an audit to review when data classifications are both successfully and unsuccessfully retrieved.

Refer to the supplemental file "AzureSQLMIAudit.sql" script.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/auditing-configure?view=azuresql

Check Contents

Determine if an audit is configured and started by executing the following query.

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status
WHERE name NOT IN ('admin_audit','SqlDbThreatDetection_ServerAudit')

If no records are returned, this is a finding.

If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the 'SCHEMA_OBJECT_ACCESS_GROUP' is included in the server audit specification.

SELECT a.name AS 'AuditName',
s.name AS 'SpecName',
d.audit_action_name AS 'ActionName',
d.audited_result AS 'Result'
FROM sys.server_audit_specifications s
JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP'

If the 'SCHEMA_OBJECT_ACCESS_GROUP' is not returned in an active audit, this is a finding.

Vulnerability Number

V-276313

Documentable

False

Rule Version

MSQL-D0-013200

Severity Override Guidance

Determine if an audit is configured and started by executing the following query.

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status
WHERE name NOT IN ('admin_audit','SqlDbThreatDetection_ServerAudit')

If no records are returned, this is a finding.

If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the 'SCHEMA_OBJECT_ACCESS_GROUP' is included in the server audit specification.

SELECT a.name AS 'AuditName',
s.name AS 'SpecName',
d.audit_action_name AS 'ActionName',
d.audited_result AS 'Result'
FROM sys.server_audit_specifications s
JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP'

If the 'SCHEMA_OBJECT_ACCESS_GROUP' is not returned in an active audit, this is a finding.

Check Content Reference

M

Target Key

5711