Azure Compliance ControlsAzure SQL Database
SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)
Azure SQL Server accessibility should be set to a minimal address range. Prowler looks for a server firewall rule that allows 0.0.0.0 to 255.255.255.255. An Internet-wide rule permits unsolicited access from any host.
What this control checks
SQL server firewall rules must not allow 0.0.0.0 to 255.255.255.255 (ANY IP)
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
5 more clauses
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- 6.3 Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP)
- 6.3 Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP)
- 4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- 4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- 4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- 5.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_database_allow_internet_access - Powerpipe Control:
azure_compliance.control.sql_database_allow_internet_access - Prowler Check:
sqlserver_unrestricted_inbound_access - KICS Query:
d7ba74da-2da0-4d4b-83c8-2fd72a3f6c28
Last reviewed: 2026-10-15