Azure SQL Managed Instance must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA), and database administrator (DBA).

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-276306	SRG-APP-000267-DB-000163	MSQL-D0-010100	SV-276306r1150025_rule	2025-10-07	1

Description
If Azure SQL Managed Instance provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. Some default database management system (DBMS) error messages can contain information that could aid an attacker in, among other things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint 'WidgetTransactionFK'. The conflict occurred in database 'DB7', table 'dbo.WidgetMaster', column 'WidgetCode''' would not, as it reveals too much about the database structure.

Description

If Azure SQL Managed Instance provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. Some default database management system (DBMS) error messages can contain information that could aid an attacker in, among other things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint 'WidgetTransactionFK'. The conflict occurred in database 'DB7', table 'dbo.WidgetMaster', column 'WidgetCode''' would not, as it reveals too much about the database structure.

ℹ️ Check
Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. Azure SQL Managed Instance generates certain system events and user-defined events to the Azure SQL Managed Instance error log. The Azure SQL Managed Instance error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: USE master GO SELECT Name FROM syslogins WHERE (sysadmin = 1 or securityadmin = 1) and hasaccess = 1; If any nonauthorized users have access to the Azure SQL Managed Instance Error Log in SQL Server Management Studio, this is a finding.

ℹ️ Check

Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. Azure SQL Managed Instance generates certain system events and user-defined events to the Azure SQL Managed Instance error log. The Azure SQL Managed Instance error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: USE master GO SELECT Name FROM syslogins WHERE (sysadmin = 1 or securityadmin = 1) and hasaccess = 1; If any nonauthorized users have access to the Azure SQL Managed Instance Error Log in SQL Server Management Studio, this is a finding.

✔️ Fix
Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by Azure SQL Managed Instance, for review by authorized personnel. If any nonauthorized users have access to the Azure SQL Managed Instance Error Log in SQL Server Management Studio. Use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles.