Azure SQL PaaS and Azure Policy interactions - azure

Question

Does anyone have any idea as to how I can restrict the IP addresses added to the SQL firewall rule via policy?
I have been attempting it for a while now, my policy looks like the below... i have tried everything - is there something im overlooking? :
{
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.SQL/servers/firewallRules"
},
{
"Not": {
"anyOf": [
{
"field": "Microsoft.Sql/servers/firewallRules/startIpAddress",
"in": "[parameters('StartIP')]"
},
{
"field": "Microsoft.Sql/servers/firewallRules/endIpAddress",
"in": "[parameters('EndIP')]"
}
]
}
}
]
},
"then": {
"effect": "Deny"
}
}
But it always throws a policy error when I update the firewall rules despite whats provided in the policy assignment.
For example, if my parameters are both " 0.0.0.0;8.8.8.8 "I would think i could have the access to Azure services enabled and 8.8.8.8 but that's not the case - I just get the same old denied due to policy error.
If I use just 0.0.0.0 as the parameter on the assignment I can provision new SQL servers, with it removed I cannot which leads me to believe that to some extent, the policy is working.
I know I can do the whole vnet route and use NSGS to accomplish just about the same thing; however, my organization does not want to go this route and would rather it be done in policy.

Answer 1

I don't have enough reputation to comment on your question. However, make sure you are being careful with your assignment parameters when entering them in the Portal. It takes the strings as-is so if you entered " 0.0.0.0;8.8.8.8 " as you specified the leading and trailing space would mess up the comparisons.
You can check to see what the exact parameter values are in the assignment by using the Get-AzureRmPolicyAssignment powershell cmdlet (or similar Azure CLI commands). To make using the cmdlet easier the full ID of the assignment is exposed on the assignment's compliance view in the Portal.