One of the most commonly requested features for Azure SQL Database has been support for more granular control of server-level firewall settings. Previously, the mechanism to manage firewall settings for traffic originating from Azure-resident services was implemented simply as an on/off switch. This meant that you were forced to either disable it altogether or enable it in a non-discriminative manner, regardless of the source IP address.

However, a recently announced public preview of Azure SQL Database and Data Warehouse VNET service endpoints and rules promises to address this limitation. This new functionality allows you to restrict inbound traffic to an Azure SQL Database server to specific Azure virtual network subnets that you designate. Even though the server remains associated with a public IP address, traffic from private IP addresses of Azure virtual machines on the designated subnets is routed via the Microsoft backbone network, rather than via the public Internet.

The solution consists of two separate components:

• Virtual network service endpoints – These represent subnet-level configuration within an Azure virtual network that specify the types of Azure services to which you intend to allow inbound connections. During the preview, service endpoints can be configured for Azure SQL Database and Azure Storage.
• SQL Database server-level virtual network rules – These represent the service-level firewall rules for Azure SQL Database server or an Azure storage account. They reference one or more subnets that you configured as virtual network service endpoints and for which you allowed this particular service type.

You have the option of delegating the task of implementing this functionality by leveraging Azure Role Based Access Control (RBAC). By default, the ability to manage virtual network service endpoints is part of privileges assigned to the Network Admin role, while the ability to manage SQL Database server-level virtual network rules is part of the privileges assigned to the Database Admin role. If you want to delegate configuration of virtual network service endpoints and service virtual network rules to the same team or individual and, at the same time, comply with the principle of least privilege, you might want to consider creating a custom role.

It is important to be aware of the limits applicable in this case. The number of virtual network-based ACL entries for a given virtual network cannot exceed 128. Additionally, this solution is available only when using Azure Resource Manager-based virtual networks and cannot be applied to legacy virtual networks provisioned using the classic deployment model.

At the time of publishing this article, there is no support for using Network Security Groups (NSGs) to restrict outbound connectivity from Azure virtual network subnets or virtual machines to IP addresses representing Azure SQL Database server endpoints. Instead, you have to make sure that NSGs permit all Internet-bound traffic. However, this is expected to change in the future by allowing the use of service tags that designate groups of IP addresses associated with a particular service type.

It is worth noting that Azure SQL Database Virtual Network Service Endpoints and Rules are currently in public preview and are available only in a limited number of Azure regions. Their functionality might change before reaching general availability.

In upcoming articles, we will step through the process of implementing this functionality in Azure SQL Database.

Stay tuned for more updates!