← Back to Microsoft Azure SQL Managed Instance Security Technical Implementation Guide

V-276248

CAT II (Medium)

Azure SQL Managed Instance must map the PKI-authenticated identity to an associated user account.

Rule ID

SV-276248r1150096_rule

STIG

Microsoft Azure SQL Managed Instance Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000187

Discussion

The DOD standard for authentication is DOD-approved PKI certificates. Once a PKI certificate has been validated, it must be mapped to an Azure SQL Managed Instance database user account or login for the authenticated identity to be meaningful to Azure SQL Managed Instance and useful for authorization decisions.

Check Content

Determine if Azure SQL Managed Instance is configured to use Microsoft Entra ID authentication only. 
 
To verify Azure Active Directory is configured as the authentication type, use the following PowerShell commands:

Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Get-AzSqlInstanceActiveDirectoryOnlyAuthentication 
 
If AzureADOnlyAuthentication returns "True", this is not a finding. 

If AzureADOnlyAuthentication returns "False" and the need for mixed mode authentication has not been documented and approved, this is a finding.

Fix Text

To set the Entra ID Administrator, use the following PowerShell command: 
  
Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Set-AzSqlInstanceActiveDirectoryAdministrator -DisplayName '<Entra Admin User/Group Name>'
 
To enable Entra ID only authentication, use the following PowerShell command: 

Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Enable-AzSqlInstanceActiveDirectoryOnlyAuthentication 
 
Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?view=azuresql-mi&amp;tabs=azure-powershell