Azure SQL databases should have private endpoint connections enabled

Private endpoint connections on Azure SQL Database should be enabled. Private endpoint connections enforce secure communication by enabling private connectivity to Azure SQL Database. The Azure Policy audit applies to `Microsoft.Sql/servers`.

Private endpoint connections enforce secure communication by enabling private connectivity to Azure SQL Database.

What this control checks

Azure SQL servers should use private endpoint connections for access

Common pitfalls

Only Approved connections count

The policy counts Microsoft.Sql/servers/privateEndpointConnections[*] where privateLinkServiceConnectionState.status equals Approved. The policy applies its effect when that count is less than 1.

Effect defaults to Audit

The effect parameter has allowed values Audit and Disabled. The defaultValue is Audit.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Private endpoint connections on Azure SQL Database should be enabled" (7698e800-9299-47a6-b3b6-5a0fee576eed); PowerPipe control azure_compliance.control.sql_server_uses_private_link.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

AC-17 Remote Access
AC-17(1) Monitoring And Control
Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

FedRAMP Moderate Baseline Rev 4

AC-4 Information Flow Enforcement
AC-17 (3): Managed Access Control Points
AC-17(1) Automated Monitoring/Control
SC-7: Boundary Protection
SC-7(3) Access Points

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.3 Control the flow of CUI in accordance with approved authorizations
3.1.12: Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
3.1.14 Route remote access via managed access control points

3 more clauses

3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks

CIS Azure Benchmark v4.0.0

2.2.2.1 Ensure Private Endpoints are used to access {service}

CMMC 2.0 Level 2

AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
AC.L2-3.1.12 Monitor and control remote access sessions
AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
AC.L2-3.1.14 Route remote access via managed access control points

3 more clauses

SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems

FedRAMP High

AC-4 Information Flow Enforcement
AC-17 Remote Access
AC-17(1) Automated Monitoring / Control
SC-7 Boundary Protection
SC-7(3) Access Points

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: sql_server_uses_private_link
Powerpipe Control: azure_compliance.control.sql_server_uses_private_link
Azure Policy Definition: 7698e800-9299-47a6-b3b6-5a0fee576eed

Last reviewed: 2026-10-15

View all Azure controls →