V-276228
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
Title
The role(s)/group(s) used to modify database structure and logic modules inside Azure SQL Server Managed Instance must be restricted to authorized users.
Description
<VulnDiscussion>If the Azure SQL Managed Instance were to allow any user to make changes to database structure or logic, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals will be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. Unmanaged changes that occur t...
Fix Text (Documentation Requirement)
Document and obtain approval for any nonadministrative user(s) who require the ability to modify database structure and logic modules. If necessary, use the ALTER ROLE and/or REVOKE commands to remove unauthorized users access to modify database structure. Examples provided below: ALTER ROLE ddladmin DROP MEMBER UnauthorizedUser; REVOKE SELECT ON OBJECT::test.table FROM UnauthorizedUser; Refer to: https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-role-transact-sql?view=azuresqldb-mi-current