STIGQter STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

The CLR Strict Security feature must be enabled for Azure SQL Server Managed Instance, unless specifically required and approved.

DISA Rule

SV-276320r1149869_rule

Vulnerability Number

V-276320

Group Title

SRG-APP-000141-DB-000093

Rule Version

MSQL-D0-017300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To enable the use of CLR Strict Security, from the query prompt:

EXEC SP_CONFIGURE 'show advanced options', 1;
RECONFIGURE WITH OVERRIDE;
EXEC SP_CONFIGURE 'CLR Strict Security', 1;
RECONFIGURE WITH OVERRIDE;
EXEC SP_CONFIGURE 'show advanced options', 0;
RECONFIGURE WITH OVERRIDE;

Reference: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/clr-strict-security?

Check Contents

The CLR Strict Security option can be disabled for backward compatibility, but this is not recommended.

To determine if CLR Strict Security is enabled, execute the following command:

SELECT name, value, value_in_use
FROM sys.configurations
WHERE name = 'CLR Strict Security'

If "value_in_use" is a "0", review the system documentation to determine whether the use of CLR Strict Security is not required and approved. If it is not approved to be disabled, this is a finding.

Vulnerability Number

V-276320

Documentable

False

Rule Version

MSQL-D0-017300

Severity Override Guidance

The CLR Strict Security option can be disabled for backward compatibility, but this is not recommended.

To determine if CLR Strict Security is enabled, execute the following command:

SELECT name, value, value_in_use
FROM sys.configurations
WHERE name = 'CLR Strict Security'

If "value_in_use" is a "0", review the system documentation to determine whether the use of CLR Strict Security is not required and approved. If it is not approved to be disabled, this is a finding.

Check Content Reference

M

Target Key

5711