VA2114 - Minimal set of principals should be members of fixed server roles

Praveenraj R K 61 Microsoft Employee

Hi Team,

I got below Vulnerabilities for the Azure SQL Managed Instance. Could you please provide the remediation for the VA ?

1 answer

Alberto Morillo 32,896 Reputation points MVP

2023-03-02T13:37:38.5566667+00:00

Remove members that should not have access to the fixed server roles. After that approve as baseline.

Here are the fixed roles except ##MS_PerformanceDefinitionReader##, ##MS_ServerPerformanceStateReader##, and ##MS_ServerSecurityStateReader#
Please sign in to rate this answer.
Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-02T14:03:12.7433333+00:00

Server role provided are for Azure SQL. Could you please help me for Azure SQL Managed instance ?

Alberto Morillo 32,896 Reputation points MVP

2023-03-02T16:19:33.7866667+00:00

Here are the fixed roles except ##MS_PerformanceDefinitionReader##, ##MS_ServerPerformanceStateReader##, and ##MS_ServerSecurityStateReader#

Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-08T16:38:42.18+00:00

I can see we have below server roles except highlighted ones ? can we delete those server roles and will it have any impact if we delete ?

Alberto Morillo 32,896 Reputation points MVP

2023-03-08T16:47:44.5233333+00:00

Fixed server roles cannot be removed as per documentation.

Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-09T06:18:09.3366667+00:00

Hi Alberto,

I have below logins for sysadmin roles. In that case what will be the exact remediation steps ? whether we need to remove sysadmin roles for these 2 logins ?

Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-14T07:30:08.71+00:00

Hi Alberto,

I can see we have sysadmin role for the below logins apart from fixed roles. So the remediation is to remove sysadmin roles to these logins ?

Praveenraj R K 61 Reputation points Microsoft Employee

2023-03-17T07:56:37.15+00:00

Hi Alberto,

we have two logins as sysadmin access. do we need to remove those sysadmin access for the remediation ?

Alberto Morillo 32,896 Reputation points MVP

2023-03-17T12:35:14.6+00:00

If you agree that they need to be sysadmin then accept it as baseline, otherwise remove them.
Sign in to comment