Azure SQL databases should have public network access disabled
Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.
Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint.
What this control checks
Azure SQL databases should have public network access disabled
Common pitfalls
Missing argument fails the check
Checkov CKV_AZURE_113 inspects public_network_access_enabled and expects False. The check returns FAILED when the argument is missing on azurerm_mssql_server.
Policy effect defaults to Audit
The effect defaults to Audit. The allowed values are Audit, Deny and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Public network access on Azure SQL Database should be disabled" (1b8ca024-1d5c-4dec-8995-b1a932b41780) and "Configure Azure SQL Server to disable public network access" (28b0b1e5-17ba-4963-a7a4-5a1ab4400a0b); PowerPipe control azure_compliance.control.sql_db_public_network_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_113; KICS query "MSSQL Server Public Network Access Enabled" (ade36cf4-329f-4830-a83d-9db72c800507); Trivy check AZU-0022.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.1 Ensure public network access is Disabled
- 5.1.7 Ensure Public Network Access is Disabled
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- Unprotected Azure SQL servers should have Azure Defender for SQL enabled
- SQL databases should have transparent data encryption enabled
- Cosmos DB accounts should use private link
- Cognitive Services accounts should have network access restrictions configured
- Service Bus namespaces should use a virtual service endpoint
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_db_public_network_access_disabled - Checkov Check:
CKV_AZURE_113 - Powerpipe Control:
azure_compliance.control.sql_db_public_network_access_disabled - Azure Policy Definitions:
1b8ca024-1d5c-4dec-8995-b1a932b41780,28b0b1e5-17ba-4963-a7a4-5a1ab4400a0b - KICS Query:
ade36cf4-329f-4830-a83d-9db72c800507 - Trivy Check:
AZU-0022
Last reviewed: 2026-10-15