You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When you create a logical server from the [Azure portal](single-database-create-quickstart.md) for Azure SQL Database and Azure Synapse Analytics, the result is a public endpoint in the format: `yourservername.database.windows.net`.
19
+
When you create a logical server from the [Quickstart: Create a single database - Azure SQL Database](single-database-create-quickstart.md) for Azure SQL Database and Azure Synapse Analytics, the result is a public endpoint in the format: `yourservername.database.windows.net`.
20
20
21
21
By default, the logical server denies all connections to ensure security. You can use one or more of the following network access controls to selectively allow access to a database via the **public endpoint**
22
22
@@ -30,12 +30,12 @@ You can also allow **private access** to the database from [virtual networks](/a
30
30
31
31
-**Private Link**: Use this feature to create a private endpoint for the [logical server in Azure](logical-servers.md) within a specific virtual network.
32
32
33
-
> [!IMPORTANT]
33
+
> [!IMPORTANT]
34
34
> This article does *not* apply to **SQL Managed Instance**. For more information about the networking configuration, see [connecting to Azure SQL Managed Instance](../managed-instance/connect-application-instance.md) .
35
35
36
36
## IP firewall rules
37
37
38
-
IP based firewall rules is a feature of the logical server in Azure that prevents all access to your server until you explicitly [add IP addresses](firewall-create-server-level-portal-quickstart.md) of the client machines.
38
+
IP based firewall rules are a feature of the logical server in Azure that prevents all access to your server until you explicitly [add IP addresses](firewall-create-server-level-portal-quickstart.md) of the client machines.
39
39
40
40
There are two types of firewall rules:
41
41
-**Server-level firewall rules**: These rules apply to all databases on the server. They can be configured through the Azure portal, PowerShell, or T-SQL commands like [sp_set_firewall_rule](/sql/relational-databases/system-stored-procedures/sp-set-firewall-rule-azure-sql-database).
@@ -46,31 +46,30 @@ The following are constraints for naming firewall rules:
46
46
- The firewall rule name can't be empty.
47
47
- It can't contain the following characters: `<, >, *, %, &, :, \\, /, ?.`
48
48
- It can't end with a period (.).
49
-
- The firewall rule name cannot exceed 128 characters.
50
-
51
-
Any attempts to create firewall rules that do not meet these constraints fails with an error message. Any modifications made to existing IP based firewall rules can take up to 5 minutes to take effect.
49
+
- The firewall rule name can't exceed 128 characters.
52
50
51
+
Any attempts to create firewall rules that don't meet these constraints fails with an error message. Any modifications made to existing IP based firewall rules can take up to 5 minutes to take effect.
53
52
54
53
## Allow Azure services
55
54
56
55
By default, during creation of a new logical server [from the Azure portal](single-database-create-quickstart.md), **Allow Azure services and resources to access this server** is unchecked and not enabled. This setting appears when connectivity is allowed via public endpoint.
57
56
58
57
You can also change this setting via the **Networking** setting after the logical server is created as follows:
59
-
60
-
![Screenshot of manage server firewall][2]
58
+
59
+
:::image type="content" source="./media/network-access-controls-overview/manage-server-firewall.png" alt-text="Screenshot of manage server firewall settings page.":::
61
60
62
61
When **Allow Azure services and resources to access this server** is enabled, your server allows communications from all resources inside the Azure boundary, **regardless of whether they are part of your subscription**. Behind the scenes, a special server-level firewall rule is added that starts and ends with IP address of `0.0.0.0`.
63
62
64
-
In many cases, enabling the setting is more permissive than what most customers want. You might want to uncheck this setting and replace it with more restrictive IP firewall rules or use one the options for private access.
63
+
In many cases, enabling the setting is more permissive than what most customers want. You might want to uncheck this setting and replace it with more restrictive IP firewall rules or use one the options for private access.
65
64
66
-
> [!IMPORTANT]
65
+
> [!IMPORTANT]
67
66
> Checking *Allow Azure services and resources to access this server* adds an IP based firewall rule with start and end IP address of 0.0.0.0
68
67
69
68
However, doing so affects the following features that run on virtual machines in Azure that aren't part of your virtual network and hence connect to the database via an Azure IP address:
70
69
71
70
### Import Export Service
72
71
73
-
Import Export Service doesn't work when **Allow Azure services and resources to access this server** isn't enabled. However you can work around the problem [by manually running SqlPackage from an Azure VM or performing the export](./database-import-export-azure-services-off.md) directly in your code by using the DACFx API.
72
+
Import Export Service doesn't work when **Allow Azure services and resources to access this server** isn't enabled. However you can work around the problem [by manually running SqlPackage from an Azure VM or performing the export](database-import-export-azure-services-off.md) directly in your code by using the DACFx API.
> Get-AzNetworkServiceTag returns the global range for SQL Service Tag despite specifying the Location parameter. Be sure to filter it to the region that hosts the Hub database used by your sync group
97
96
98
97
The output of the PowerShell script is in Classless Inter-Domain Routing (CIDR) notation. This needs to be converted to a format of Start and End IP address using [Get-IPrangeStartEnd.ps1](https://www.sqltechnet.com/2020/12/powershell-set-azure-sql-firewall-for.html) like this:
@@ -119,46 +118,37 @@ You can now add these as distinct firewall rules and then disable the setting **
119
118
120
119
## Sql Service Tag
121
120
122
-
[Service tags](/azure/virtual-network/service-tags-overview) can be used in security rules and routes from clients to SQL Database. Service tags can be used in network security groups, Azure Firewall, and user-defined routes by specifying them in the source or destination field of a security rule.
121
+
[Service tags](/azure/virtual-network/service-tags-overview) can be used in security rules and routes from clients to SQL Database. Service tags can be used in network security groups, Azure Firewall, and user-defined routes by specifying them in the source or destination field of a security rule.
123
122
The **Sql** service tag consists of all IP addresses that are being used by SQL Database. The tag is further segmented by regions. For example **Sql.WestUS** lists all the IP addresses used by SQL Database in West US.
124
123
125
124
The **Sql** service tag consists of IP addresses that are required to establish connectivity to SQL Database as documented in [Gateway IP addresses](connectivity-architecture.md#gateway-ip-addresses). Additionally, a service tag will also be associated with any outbound traffic from SQL Database used in features such as:
126
125
127
-
-[Auditing](auditing-overview.md)
126
+
-[Auditing for Azure SQL Database and Azure Synapse Analytics](auditing-overview.md)
-[PowerShell and Azure CLI: Enable Transparent Data Encryption with customer-managed key from Azure Key Vault](transparent-data-encryption-byok-configure.md)
135
134
136
135
## SqlManagement Service Tag
137
136
138
137
SqlManagement service tag is used for control plane operations against SQL Database.
139
138
140
139
## Virtual network firewall rules
141
140
142
-
[Virtual network firewall rules](vnet-service-endpoint-rule-overview.md) are easier alternatives to establish and manage access from a specific subnet that contains your VMs.
141
+
[Use virtual network service endpoints and rules for servers in Azure SQL Database](vnet-service-endpoint-rule-overview.md) are easier alternatives to establish and manage access from a specific subnet that contains your VMs.
143
142
144
143
## Private Link
145
144
146
145
Private Link allows you to connect to a server via a **private endpoint**. A [private endpoint](private-endpoint-overview.md) is a private IP address within a specific [virtual network](/azure/virtual-network/virtual-networks-overview) and subnet.
147
146
148
147
## Related content
149
148
150
-
- For a quickstart on creating a server-level IP firewall rule, see [Create a database in SQL Database](single-database-create-quickstart.md).
151
-
152
-
- For a quickstart on creating a server-level virtual network firewall rule, see [Virtual Network service endpoints and rules for Azure SQL Database](vnet-service-endpoint-rule-overview.md).
153
-
154
-
- For help with connecting to a database in SQL Database from open source or partner applications, see [Client quickstart code samples to SQL Database](/previous-versions/azure/ee336282(v=azure.100)).
155
-
156
-
- For information on other ports that you might need to open, see the **SQL Database: Outside vs inside** section of [Ports beyond 1433 for ADO.NET 4.5 and SQL Database](adonet-v12-develop-direct-route-ports.md)
157
-
158
-
- For an overview of Azure SQL Database Connectivity, see [Azure SQL Connectivity Architecture](connectivity-architecture.md)
159
-
160
-
- For an overview of Azure SQL Database security, see [Securing your database](security-overview.md)
# Azure SQL Database server roles for permission management
@@ -34,7 +34,7 @@ Like SQL Server on-premises, server permissions are organized hierarchically. Th
34
34
For example, the server-level role `##MS_ServerStateReader##` holds the permission `VIEW SERVER STATE`. If a login who is member of this role has a user account in the databases `master` and `WideWorldImporters`, this user has the permission `VIEW DATABASE STATE` in those two databases.
35
35
36
36
> [!NOTE]
37
-
> Any permission can be denied within user databases, in effect, overriding the server-wide grant via role membership. However, in the system database *master*, permissions can't be granted or denied.
37
+
> Any permission can be denied within user databases, in effect, overriding the server-wide grant via role membership. However, in the system database `master`, permissions can't be granted or denied.
38
38
39
39
Azure SQL Database currently provides seven fixed server roles. The permissions that are granted to the fixed server roles can't be changed and these roles can't have other fixed roles as members. You can add server-level logins as members to server-level roles.
40
40
@@ -163,7 +163,7 @@ GO
163
163
164
164
#### Part 2: Testing role membership
165
165
166
-
Log in as login `Jiao` and connect to the user database used in the example.
166
+
Sign in as login `Jiao` and connect to the user database used in the example.
167
167
168
168
```sql
169
169
-- retrieve server-level permissions of currently logged on User
0 commit comments