Azure SQL Managed Instance STIG Checklist

20 items · Security · Hard difficulty · 4 hours

Secure and validate Azure SQL Managed Instance per the DISA STIG.

• Obtain the official DISA STIG for Azure SQL Managed Instance

  Download the latest STIG from https://cyber.mil/ or public.cyber.mil if needed.

• Confirm deployment is in a DoD tenant with applicable FedRAMP controls

  Ensure the subscription/tenant meets DoD/FedRAMP obligations before applying STIG controls.

• Restrict network access using private endpoints and virtual network integration
• Create private endpoints and dedicated subnets for the managed instance

  Use Private Link and isolated subnets to remove public exposure.

• Disable public endpoint and enforce virtual network-only access

  Turn off public connectivity unless explicitly required and documented.

• Configure firewall rules to limit allowed IP ranges

  Apply least-privilege IP restrictions and use service tags where appropriate.

• Enforce Azure AD authentication and disable SQL authentication where possible

  Prefer managed identities and Azure AD logins over SQL logins.

• Enable multi-factor authentication for all administrative accounts

  Require MFA for admin roles accessing the managed instance.

• Configure role-based access control and least-privilege for DB admins

  Assign only required roles; avoid broad contributor permissions.

• Enable Transparent Data Encryption (TDE) for the managed instance

  Use platform-managed keys or customer-managed keys per policy.

• Enforce TLS 1.2 or higher for in-transit encryption

  Disable TLS 1.0/1.1 and require modern ciphers for connections.

• Enable managed identities for services and remove embedded credentials

  Use managed identities for automated services instead of secrets.

• Enable auditing and send logs to Log Analytics or a SIEM

  Capture admin actions, schema changes, and access events for review.

• Send audit logs to a Log Analytics workspace

  Configure workspace or event hub integration for centralized logging.

• Set audit log retention per DoD policy

  Apply the retention period required by your compliance mandate.

• Enable Advanced Threat Protection and run vulnerability assessments

  Activate threat detection features and schedule scans regularly.

• Implement automated backups and verify restore procedures

  Confirm backup retention and perform a test restore to validate.

• Validate patching and maintenance schedules for the managed instance

  Confirm vendor and platform patches are applied per maintenance window.

• Configure alerting for suspicious activity and failed login attempts

  Send alerts to SOC or on-call teams for rapid investigation.

• Review and document configuration, exceptions, and STIG change contact

  Record deviations, remediation plans, and send STIG comments to DISA.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.