{AzureSqlDbServer}, SQL Database Server, allows ingress any ip ( SQL Server includes a firewall that allows to define which connections are authorized and unauthorized. By default, for a SQL Server, a Firewall exists with StartIp of and EndIP of allowing access to all the Azure services. Additionally, a custom rule can be set up with StartIp of and EndIP of allowing access from any ip over the internet. In order to reduce the potential attacks of a SQL server, firewall rules should be defined with more restricted ip addresses by referencing the range of addresses available for a specific SQL Server.
  • Recommended Mitigation

    For each SQL server, click on Networking and disable public access or edit the firewall rules to limit access to only authorized connections.