Does Azure SQL Database firewall automatically allow VM's in the same Resource Group?

0
votes

Using Azure Resource Manager.

I have an Azure SQL Database resource, and even when I delete all "allow" firewall (on the sql server's blade) rules, my VM is still able to query the SQL DB.
EVEN when I set "Allow Access" to no for the ip address of the VM, I can still query the DB. How??

Is this because Azure automatically allows resources in the same Resource Group to access it? Even without explicit Firewall allow rules?

2
sqlsql-serverazurefirewallazure-resource-manager
Are you referring to SQL Database service, or SQL Server in a VM? Asking only because you must add firewall rules to the SQL Database service instance to allow access. Resource Groups have zero to do with it. If you could edit your question to clarify, that would help. Maybe also show how you're connecting, and what type of queries you're able to run? (just please don't inadvertently expose real server name, username, or password) - David Makogon
Do you have the "Allow access to Azure services" option turned on? - bmoore-msft
@bmoore-msft Yes that would be it. Thank you! I had thought it was referring to background Azure services running, like the vm agent and such. - AllTradesJack

2 Answers

2
votes

Under the Firewall section of the SQL Server blade, there's a switch called "Allow access to Azure services". Having this on will allow any Azure resource to access get through the firewall (they will still need your username and password of course to actually access the server). This includes Azure resources on other people's subscriptions. See this answer.

I had this turned on and that's why my firewall settings made no difference for my VM's.

1
votes

Not exactly sure what's happening with your specific situation, security-wise, but Resource Groups have nothing to do with it. Resource Groups help organize resources within a single container, where you can manage those resources better (e.g. add users to the Resource Group without adding them to the rest of your subscription). They don't play a role in communication between Azure services.