Back to Checks
azure

Subscription has an Activity Log alert for SQL Server firewall rule create or update events

monitor_alert_create_update_sqlserver_fr
Service: monitorSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.insights/activitylogalerts

Azure Monitor activity log alerts are configured for Azure SQL Server firewall rule changes, targeting the Microsoft.Sql/servers/firewallRules/write operation.

This evaluates whether notifications or automated actions are set when firewall rules are created or updated.

Prowler logoProwlerprowler-provider-azure

Risk

Without alerting on firewall rule changes, unauthorized or accidental openings can remain unnoticed, exposing databases to untrusted networks.

This harms confidentiality (data exfiltration via widened IP ranges) and integrity (unauthorized queries), while increasing attacker dwell time.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks monitor_alert_create_update_sqlserver_fr

Recommendation

Enable an activity log alert for Microsoft.Sql/servers/firewallRules/write and route it to responsive action groups.

Apply least privilege for firewall management, enforce change approvals, and use defense in depth: prefer private endpoints and avoid broad public network access.

Remediation

CLI

az monitor activity-log alert create --name <activity_log_rule_name> --resource-group <resource_group_name> --scopes /subscriptions/<subscription_id> --condition "category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/write" --location global

Terraform

# Activity Log alert for SQL Server firewall rule create/update
resource "azurerm_monitor_activity_log_alert" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  scopes              = ["/subscriptions/<example_resource_id>"]

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Sql/servers/firewallRules/write" # Critical: alert on SQL Server firewall rule create/update
  }
}

NativeIaC

// Activity Log alert for SQL Server firewall rule create/update
resource example_activity_log_alert 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: '<example_resource_name>'
  location: 'Global'
  properties: {
    enabled: true
    scopes: [ '/subscriptions/<example_resource_id>' ]
    condition: {
      allOf: [
        {
          field: 'category'
          equals: 'Administrative'
        }
        {
          field: 'operationName'
          equals: 'Microsoft.Sql/servers/firewallRules/write' // Critical: alert on SQL Server firewall rule create/update
        }
      ]
    }
  }
}

Other

1In the Azure portal, go to Monitor > Alerts > + Create > Alert rule
2Scope: Select the subscription and click Done
3Condition: Choose Signal type "Activity log", then set
4- Category: Administrative
5- Operation name: Microsoft.Sql/servers/firewallRules/write
6Click Done
7Actions: Skip (no action group required)
8Details: Enter an Alert rule name and ensure Enable alert rule upon creation is checked
9Review + create > Create

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
from prowler.providers.azure.services.monitor.monitor_client import monitor_client


class monitor_alert_create_update_sqlserver_fr(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            activity_log_alerts,
        ) in monitor_client.alert_rules.items():
            subscription_name = monitor_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for alert_rule in activity_log_alerts:
                if check_alert_rule(
                    alert_rule, "Microsoft.Sql/servers/firewallRules/write"
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=alert_rule
                    )
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {subscription_name} ({subscription_id})."
                    break
            else:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"There is not an alert for creating/updating SQL Server firewall rule in subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References