Ensure Public Network Access is Disabled for SQL Servers

Overview

Disabling public network access restricts the service from accessing public networks.

Rationale

A secure network architecture requires carefully constructed network segmentation. Public Network Access tends to be overly permissive and introduces unintended vectors for threat activity.

Impact

Some architectural considerations may be necessary to ensure that network connectivity is available. No additional cost or performance impact is required to deploy this recommendation.

Default Value

By default, Azure SQL Server's Public network access is set to Disable.

Remediation guidance

From Azure Portal

Open the SQL server using the Open in Azure button
Under Security, click Networking.
Set Public network access to Disable.
Click Save.

From Azure CLI

For each SQL server with publicNetworkAccess Enabled, set it to Disabled:

az sql server update -n <sqlServerName> -g <resourceGroup> --set publicNetworkAccess="Disabled"

From PowerShell

For each SQL server with PublicNetworkAccess Enabled, set it to Disabled:

Set-AzSqlServer -ServerName <sqlServerName> -ResourceGroupName <resourceGroup> -PublicNetworkAccess "Disabled"

Service-wide remediation

Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.

Azure

Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.

Operational rollout

Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
Re-scan and track approved exceptions with an owner and expiry date.

Query logic

These are the stored checks tied to this control.

Azure SQL Servers allowing public access

Connectors

Microsoft Azure

Covered asset types

SQLServer

Expected check: eq []

{
  sqlServers(where: { publicNetworkAccess: "Enabled" }) {
    ...AssetFragment
  }
}