Check ID: monitor_alert_create_update_sqlserver_fr
Provider: Azure
Service: monitor
Severity: MEDIUM
Categories: logging
Resource type: microsoft.insights/activitylogalerts

What this check verifies

Azure Monitor activity log alerts are configured for Azure SQL Server firewall rule changes, targeting the Microsoft.Sql/servers/firewallRules/write operation. This evaluates whether notifications or automated actions are set when firewall rules are created or updated.

Risk

Without alerting on firewall rule changes, unauthorized or accidental openings can remain unnoticed, exposing databases to untrusted networks. This harms confidentiality (data exfiltration via widened IP ranges) and integrity (unauthorized queries), while increasing attacker dwell time.

Recommendation

Enable an activity log alert for Microsoft.Sql/servers/firewallRules/write and route it to responsive action groups. Apply least privilege for firewall management, enforce change approvals, and use defense in depth: prefer private endpoints and avoid broad public network access.

Remediation

az monitor activity-log alert create --name <activity_log_rule_name> --resource-group <resource_group_name> --scopes /subscriptions/<subscription_id> --condition "category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/write" --location global

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_alert_create_update_sqlserver_fr. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks