Azure托管实例：为何会列出扩展存储过程？

Great question—this is a common point of confusion with Azure Managed Instance (MI) and its vulnerability assessment tooling, so let’s break this down step by step.

First, let’s confirm your core understanding: Azure Managed Instance does not support user-created extended stored procedures—this is clearly documented, and MI’s architecture restricts users from adding custom extended procs. That said, there are a few key reasons you might still see this alert:

1. System-level extended stored procedures exist (but are locked down) #

While you can’t create your own extended procs, Microsoft maintains a small set of system-level extended stored procedures for internal MI operations. These are not accessible or executable by regular user accounts—only highly privileged system identities can interact with them. The vulnerability assessment tool may detect their presence and flag them based on generic SQL Server vulnerability rules, even though the actual risk to your instance is negligible.

2. Vulnerability assessment rules may not be fully MI-aware #

The Azure Vulnerability Assessment service uses benchmark rules that are often built for traditional on-premises SQL Server or Azure SQL Database. Some of these rules don’t account for MI’s specific security restrictions (like blocked user access to system extended procs). As a result, the tool may trigger a false positive alert because it detects the existence of the procs, but doesn’t verify whether they’re actually exploitable in the MI context.

How to verify if this is a false positive #

To confirm the risk level and address the alert:

• List all extended stored procedures in your instance using this query:

  SELECT name, type_desc, is_ms_shipped 
  FROM sys.objects 
  WHERE type_desc = 'EXTENDED_STORED_PROCEDURE';
  

  Look for the is_ms_shipped flag—if all results are 1, these are Microsoft-maintained system procs.
• Check permissions for these procs to ensure regular users can’t execute them:

  EXEC sp_helprotect @username = 'public', @objname = '<your-procedure-name>';
  

  If no permissions are granted to public or non-admin users, there’s no exploitable risk.
• Mark the alert as a false positive in the Azure Portal if you confirm the procs are system-owned and non-exploitable. You can also submit feedback to Azure support to refine the vulnerability assessment rules for MI.

In most cases, this alert is a false positive triggered by generic rules that don’t account for MI’s unique security controls. The system-level extended procs are safe and required for MI’s operation, so you don’t need to take remediation action unless you find unusual permissions or non-system procs.

内容的提问来源于stack exchange，提问作者Francesco Mantovani