Azure Compliance ControlsAzure SQL Database
Azure SQL databases should have public network access disabled
Disabling the public network access property improves security by ensuring your Azure SQL Database can only be accessed from a private endpoint. This configuration denies all logins that match IP or virtual network based firewall rules.
What this control checks
Azure SQL databases should have public network access disabled
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.1 Ensure public network access is Disabled
- 5.1.7 Ensure Public Network Access is Disabled
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- Unprotected Azure SQL servers should have Azure Defender for SQL enabled
- SQL databases should have transparent data encryption enabled
- Cosmos DB accounts should use private link
- Cognitive Services accounts should have network access restrictions configured
- Service Bus namespaces should use a virtual service endpoint
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_db_public_network_access_disabled - Checkov Check:
CKV_AZURE_113 - Powerpipe Control:
azure_compliance.control.sql_db_public_network_access_disabled - Azure Policy Definitions:
1b8ca024-1d5c-4dec-8995-b1a932b41780,28b0b1e5-17ba-4963-a7a4-5a1ab4400a0b - KICS Query:
ade36cf4-329f-4830-a83d-9db72c800507 - Trivy Check:
AZU-0022
Last reviewed: 2026-10-15