# Cis Azure Database 9.2

> Ensure that 'Public Network Access' is set to 'Disable'

- Skill: `cyberstrikeus/cis-azure-database-9-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-database-9-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-database-9-2/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-database-9-2

---


# 9.2 Ensure that 'Public Network Access' is set to 'Disable' (Automated)

## Profile Applicability

- Level 2

## Description

Disabling public network access restricts the service from accessing public networks.

## Rationale

A secure network architecture requires carefully constructed network segmentation. Public network access is overly permissive and introduces unintended vectors for threat activity.

## Impact

Disabling 'Public Network Access' forces the requirement of the use of Private Endpoints for network connectivity which will require some additional consideration from a network architecture perspective and will introduce cost based on the inbound/outbound data being processed by the Private Endpoint.

## Audit Procedure

### Audit from Azure Portal

1. Go to `SQL servers`.
2. For each SQL server, under `Security`, click `Networking`.
3. Ensure that `Public network access` is set to `Disable`.

### Audit from Azure CLI

List all SQL Servers and ensure `publicNetworkAccess` is not `Enabled`:

```bash
az sql server list --query "[].{name:name, resourceGroup:resourceGroup, publicNetworkAccess:publicNetworkAccess}"
```

### Audit from PowerShell

List all SQL Servers and ensure `PublicNetworkAccess` is not `Enabled`:

```powershell
Get-AzSqlServer | Select-Object -Property ServerName, ResourceGroupName, PublicNetworkAccess
```

### Audit from Azure Policy

Policy ID: `1b8ca024-1d5c-4dec-8995-b1a932b41780`
Name: 'Public network access on Azure SQL Database should be disabled'

## Expected Result

`Public network access` should be set to `Disable`.

## Remediation

### Remediate from Azure Portal

1. Go to `SQL servers`.
2. For each SQL server, under `Security`, click `Networking`.
3. Set `Public network access` to `Disable`.
4. Click `Save`.

### Remediate from Azure CLI

For each SQL server with `publicNetworkAccess` `Enabled`, set it to `Disabled`:

```bash
az sql server update -n <sqlServerName> -g <resourceGroup> --set publicNetworkAccess="Disabled"
```

### Remediate from PowerShell

For each SQL server with `PublicNetworkAccess` `Enabled`, set it to `Disabled`:

```powershell
Set-AzSqlServer -ServerName <sqlServerName> -ResourceGroupName <resourceGroup> -PublicNetworkAccess "Disabled"
```

## Default Value

By default, Azure SQL Server's public network access is set to `Disable`.

## References

1. https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-network-security#ns-2-secure-cloud-services-with-network-controls
2. https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings?view=azuresql&tabs=azure-portal#deny-public-network-access

## Profile

- Level 2