# Prevent Azure SQL Database Ingress from 0.0.0.0/0 to Restrict Open Internet Access

- Source: https://support.icompaas.com/support/solutions/articles/62000234801-prevent-azure-sql-database-ingress-from-0-0-0-0-0-to-restrict-open-internet-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112693) › [Azure Database Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169261)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**

-   **Level 1**  
    

**Description:** This check ensures that no Azure SQL Databases have firewall rules that allow ingress from 0.0.0.0/0, which represents any IP address. By limiting access to trusted IP addresses or ranges, you prevent unauthorized access and reduce the attack surface for the database.

**Rationale:** Allowing access from any IP address (0.0.0.0/0) exposes the SQL database to all networks, including untrusted external sources. Restricting access to trusted networks ensures better security by preventing unauthorized connections and attacks from the public internet.

**Impact:**

-   Pros:  
    
    -   Reduces exposure to external threats by limiting the IP addresses that can access the database.  
        
    -   Enhances security by preventing open access to the database from the internet.  
        
    -   Helps in regulatory compliance for secure network configurations.  
        
-   Cons:  
    
    -   Could disrupt services if not properly configured to allow necessary IPs or services to connect.  
        

**Default Value:**

By default, SQL servers might have a firewall rule allowing access from all IPs, including 0.0.0.0/0.  

**Pre-requisites:** Ensure that appropriate network configurations, such as private IPs or Virtual Networks (VNets), are in place for legitimate services and applications that need access.

**Remediation**

**Test Plan:**

**Using Azure Portal:**

1.  Log in to the Azure Portal: [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to SQL Servers.  
    
3.  Select the SQL Server instance.  
    
4.  Under Networking, ensure that Allow Azure services and resources to access this server is unchecked.  
    
5.  Review all firewall rules for the server, ensuring that no rule allows access from 0.0.0.0/0.  
    

**Using Azure CLI:** 1. Run the following command to list the firewall rules for the SQL server:

az sql server firewall-rule list --resource-group <resource-group-name> --server <sql-server-name>

-   Ensure that the output does not contain any rules allowing access from 0.0.0.0/0 or any rule named AllowAllWindowsAzureIps.  
      
    

**Implementation Plan:**

**Using Azure Portal:**

1.  Navigate to SQL Servers.  
    
2.  Select the server and go to Networking.  
    
3.  Uncheck Allow Azure services and resources to access this server.  
    
4.  Review and delete any firewall rule with a start IP of 0.0.0.0.  
    

**Using Azure CLI:**  
1\.  To disable the default rule allowing access to Azure services, run:

az sql server firewall-rule delete --resource-group <resource-group-name> --server <sql-server-name> --name "AllowAllWindowsAzureIps"

  

2\. To delete any custom rule allowing access from 0.0.0.0/0, run:

az sql server firewall-rule delete --resource-group <resource-group-name> --server <sql-server-name> --name <firewall-rule-name>

  

**Backout Plan:**

**Using Azure Portal:**

1.  Go to SQL Servers.  
    
2.  Under Networking, re-enable Allow Azure services and resources to access this server if necessary.  
    

**Using Azure CLI:**  
1.  To re-enable access from Azure services, run

az sql server firewall-rule create --resource-group <resource-group-name> --server <sql-server-name> --name "AllowAllWindowsAzureIps" --start-ip-address "0.0.0.0" --end-ip-address "0.0.0.0"

**References:**

-   [Configure SQL Database Firewall Rules  
    ](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure)
    
-   [Disable Access for Azure Services  
      
    ](https://learn.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure#disable-access-for-azure-services)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.