# 6.3.3 Ensure 'user connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233042-6-3-3-ensure-user-connections-database-flag-for-cloud-sql-sql-server-instance-is-set-to-a-non-limit - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 1 Description: The user connections database flag should be configured to ensure it does not impose an unnecessary limit on the number of simultaneous connections for Cloud SQL SQL Server instances. This flag controls the maximum number of concurrent user connections allowed. By default, it is set to 0, which permits the SQL Server to dynamically allocate up to the maximum of 32,767 connections. Setting a limiting value may result in service disruptions when the connection limit is reached. Rationale: The user connections option is a self-configuring value that dynamically adjusts based on demand, allowing SQL Server to handle up to 32,767 connections. Limiting this value unnecessarily can result in dropped connection requests, potentially causing application outages or data loss. Ensuring this flag is set to 0 allows SQL Server to manage connections efficiently without imposing artificial restrictions. Impact: - Setting a restrictive value for user connections may limit the number of allowed connections, potentially leading to service disruptions. - Modifying flags via the command line will overwrite previously configured flags, so all required flags should be included in a single command. - Updates to this flag may restart the database, causing temporary unavailability. It is recommended to apply changes during periods of low usage. Default Value: The default value for user connections is 0, which does not limit the number of connections, allowing SQL Server to dynamically manage up to 32,767 connections. Audit Steps: ##### Using Google Cloud Console: 1. Navigate to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                   ![](https://support.icompaas.com/assets/kb/821cbef009fdd03a.png) 2. Select the SQL Server instance to view its Instance Overview page.               ![](https://support.icompaas.com/assets/kb/546e109f70d2b866.png) 3. Under the Database flags section, verify that the user connections flag is set to 0.                 ![](https://support.icompaas.com/assets/kb/193dafadcdc2fb00.png) Using Google Cloud CLI: Run the following command to check the value of the user connections flag: gcloud sql instances describe --format=json | jq '.settings.databaseFlags\[\] | select(.name=="user connections")|.value' 1. Ensure the returned value is 0. Remediation Steps: ##### Using Google Cloud Console: 1. Navigate to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                      ![](https://support.icompaas.com/assets/kb/83828aa781516704.png) 2. Select the SQL Server instance where the flag needs to be modified.            ![](https://support.icompaas.com/assets/kb/d4a2b7decbd698b0.png) 3. Click Edit.         ![](https://support.icompaas.com/assets/kb/84b8ca5ead8a3fd0.png) 4. Scroll to the Flags section.                ![](https://support.icompaas.com/assets/kb/63211b5c9da6a37f.png) 5. Add or modify the user connections flag and set its value to 0.                 ![](https://support.icompaas.com/assets/kb/f96ff5e109a23dff.png) 6. Click Save to apply the changes.                ![](https://support.icompaas.com/assets/kb/bceba1ae52a9dd49.png) 7. Confirm the changes under the Flags section on the Overview page.           ![](https://support.icompaas.com/assets/kb/8bf538c90e255131.png) ##### Using Google Cloud CLI: Configure the user connections database flag using the following command: gcloud sql instances patch --database-flags "user connections=0" 1. Ensure the instance reflects the updated configuration. ## Backout Plan: Step 1: Restore the user connections Flag If Needed If setting user connections=0 causes performance issues, restore a controlled limit: gcloud sql instances patch --database-flags "user connections=500" Step 2: Notify Stakeholders Inform database administrators before making connection limit changes Step 3: Restore from Backup (If Necessary) - If modifying user connections c**auses failures****, restore the SQL instance from a backup.** **Step 4: Validate Rollback Success** **Run the audit steps again to confirm that the new user connections setting is applied****.** References: 1. [Cloud SQL SQL Server Flags Documentation](https://cloud.google.com/sql/docs/sqlserver/flags) 2. [Microsoft SQL Server: User Connections Configuration](https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-user-connections-server-configuration-option?view=sql-server-ver15) Additional Information: - Changes to database flags may require the instance to restart. Check the list of flags requiring restarts at [Cloud SQL SQL Server Flags Documentation](https://cloud.google.com/sql/docs/sqlserver/flags). - Avoid setting unnecessarily restrictive limits on connections, as this may impact application performance. - Ensure that all required flags are included when updating the configuration to prevent unintended changes. CIS Controls:

Control

Description

IG 1

IG 2

IG 3

4.1 Establish and Maintain a Secure Configuration Process

Establish secure configuration standards for enterprise assets, updating them annually or as needed.

✅

✅

✅

5.1 Establish Secure Configurations

Maintain documented and standardized security configurations for all authorized operating systems and software.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.