Azure SQL Managed Instance must map the PKI-authenticated identity to an associated user account.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-276248	SRG-APP-000177-DB-000069	MSQL-00-008500	SV-276248r1150096_rule	2025-10-07	1

Description
The DOD standard for authentication is DOD-approved PKI certificates. Once a PKI certificate has been validated, it must be mapped to an Azure SQL Managed Instance database user account or login for the authenticated identity to be meaningful to Azure SQL Managed Instance and useful for authorization decisions.

ℹ️ Check
Determine if Azure SQL Managed Instance is configured to use Microsoft Entra ID authentication only. To verify Azure Active Directory is configured as the authentication type, use the following PowerShell commands: Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' \| Get-AzSqlInstanceActiveDirectoryOnlyAuthentication If AzureADOnlyAuthentication returns "True", this is not a finding. If AzureADOnlyAuthentication returns "False" and the need for mixed mode authentication has not been documented and approved, this is a finding.

ℹ️ Check

Determine if Azure SQL Managed Instance is configured to use Microsoft Entra ID authentication only. To verify Azure Active Directory is configured as the authentication type, use the following PowerShell commands: Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Get-AzSqlInstanceActiveDirectoryOnlyAuthentication If AzureADOnlyAuthentication returns "True", this is not a finding. If AzureADOnlyAuthentication returns "False" and the need for mixed mode authentication has not been documented and approved, this is a finding.

✔️ Fix
To set the Entra ID Administrator, use the following PowerShell command: Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' \| Set-AzSqlInstanceActiveDirectoryAdministrator -DisplayName '<Entra Admin User/Group Name>' To enable Entra ID only authentication, use the following PowerShell command: Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' \| Enable-AzSqlInstanceActiveDirectoryOnlyAuthentication Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?view=azuresql-mi&tabs=azure-powershell

✔️ Fix

To set the Entra ID Administrator, use the following PowerShell command: Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Set-AzSqlInstanceActiveDirectoryAdministrator -DisplayName '<Entra Admin User/Group Name>' To enable Entra ID only authentication, use the following PowerShell command: Get-AzSqlInstance -Name '<Azure SQL Managed Instance Name>' | Enable-AzSqlInstanceActiveDirectoryOnlyAuthentication Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?view=azuresql-mi&tabs=azure-powershell