SQL servers should use a virtual network service endpoint
This policy audits any SQL Server not configured to use a virtual network service endpoint. The Azure Policy definition targets `Microsoft.Sql/servers`. It looks for a related `Microsoft.Sql/servers/virtualNetworkRules` resource.
What this control checks
Azure Policy check ae5d2f14-d830-42b6-9899-df6cfe9c71a3 applies to Microsoft.Sql/servers with effect AuditIfNotExists. It looks for Microsoft.Sql/servers/virtualNetworkRules where virtualNetworkSubnetId exists. The Powerpipe check sql_server_use_virtual_service_endpoint is defined as a control titled "SQL Server should use a virtual network service endpoint".
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0862.09m2Organizational.8-09.m 09.06 Network Security Management
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_use_virtual_service_endpoint - Powerpipe Control:
azure_compliance.control.sql_server_use_virtual_service_endpoint - Azure Policy Definition:
ae5d2f14-d830-42b6-9899-df6cfe9c71a3
Last reviewed: 2026-10-15