SQL Server firewall rules should not permit start and end IP addresses to be 0.0.0.0

Description

SQL server firewall rules should not permit start and end IP addresses to be 0.0.0.0. Adding a rule with range 0.0.0.0 to 0.0.0.0 is the same as enabling the “Allow access to Azure services” setting, which allows all connections from Azure, including from other subscriptions. Disabling this setting helps prevent malicious Azure users from connecting to your database and accessing sensitive data.

Portal Remediation Steps

Disable the “Allow access to Azure services” setting:

  • Navigate to SQL Servers and select your server

  • Select Firewalls and Virtual Networks

  • Set the “Allow access to Azure services” control to OFF

To allow specific Azure services to connect to the SQL server, consider setting up a virtual network service endpoint and rules.

Azure CLI Remediation Steps

  • List all firewall rules for a SQL server:

    • az sql server firewall-rule list -g <your-resource-group> -s <your-sql-server>

  • Look for rules with a start and end IP address of 0.0.0.0 and copy the rule ID

  • Delete the rule:

    • az sql server firewall-rule delete --ids <your-firewall-rule-id>

To allow specific Azure services to connect to the SQL server, consider setting up a virtual network service endpoint and rules.