VA2114 - Minimal set of principals should be members of fixed server roles

Question

VA2114 - Minimal set of principals should be members of fixed server roles

Praveenraj R K 61 Microsoft Employee

Hi Team,

I got below Vulnerabilities for the Azure SQL Managed Instance. Could you please provide the remediation for the VA ?

VA2114 - Minimal set of principals should be members of fixed server roles

1 answer

Your answer

Answer 1

Alberto Morillo 34,656 MVP Moderator

Remove members that should not have access to the fixed server roles. After that approve as baseline. User's image

Here are the fixed roles except ##MS_PerformanceDefinitionReader##, ##MS_ServerPerformanceStateReader##, and ##MS_ServerSecurityStateReader#

Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-02T14:03:12.7433333+00:00

Server role provided are for Azure SQL. Could you please help me for Azure SQL Managed instance ?
Alberto Morillo 34,656 Reputation points MVP Moderator

2023-03-02T16:19:33.7866667+00:00

Here are the fixed roles except ##MS_PerformanceDefinitionReader##, ##MS_ServerPerformanceStateReader##, and ##MS_ServerSecurityStateReader#
Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-08T16:38:42.18+00:00

I can see we have below server roles except highlighted ones ? can we delete those server roles and will it have any impact if we delete ?
Alberto Morillo 34,656 Reputation points MVP Moderator

2023-03-08T16:47:44.5233333+00:00

Fixed server roles cannot be removed as per documentation.
Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-09T06:18:09.3366667+00:00

Hi Alberto,

I have below logins for sysadmin roles. In that case what will be the exact remediation steps ? whether we need to remove sysadmin roles for these 2 logins ?
Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-14T07:30:08.71+00:00

Hi Alberto,

I can see we have sysadmin role for the below logins apart from fixed roles. So the remediation is to remove sysadmin roles to these logins ?
Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-17T07:56:37.15+00:00

Hi Alberto,

we have two logins as sysadmin access. do we need to remove those sysadmin access for the remediation ?
Alberto Morillo 34,656 Reputation points MVP Moderator

2023-03-17T12:35:14.6+00:00

If you agree that they need to be sysadmin then accept it as baseline, otherwise remove them.

Share via

VA2114 - Minimal set of principals should be members of fixed server roles

1 answer

Your answer