Activity log alert should exist for Create or Update SQL Server Firewall Rule

What does this mean?

This recommendation ensures that Azure Activity Log alerts are configured to trigger when SQL Server firewall rules are created or updated. Changes to firewall rules can expose databases to unauthorized networks.

Benefits of implementation

• Immediate notification of firewall rule changes
• Enables rapid response to unauthorized network access changes
• Supports change management and audit requirements

Drawbacks and considerations

• Generates alerts for both legitimate and suspicious changes
• Requires alert routing and response procedures
• May produce alert fatigue in environments with frequent changes

Implementation

Implementation guidance coming soon.

Related recommendations

Related recommendations will be linked here.