SQL servers should use a virtual network service endpoint
This policy audits any SQL Server not configured to use a virtual network service endpoint. The Azure Policy definition targets `Microsoft.Sql/servers`. It looks for a related `Microsoft.Sql/servers/virtualNetworkRules` resource.
What this control checks
SQL servers should use a virtual network service endpoint
Common pitfalls
Effect can be set to Disabled
The allowedValues for the effect are "AuditIfNotExists" and "Disabled". The defaultValue is "AuditIfNotExists".
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "SQL Server should use a virtual network service endpoint" (ae5d2f14-d830-42b6-9899-df6cfe9c71a3); PowerPipe control azure_compliance.control.sql_server_use_virtual_service_endpoint.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 0805.01m1Organizational.12-01.m (01.04 Network Access Control), 0806.01m2Organizational.12356-01.m (01.04 Network Access Control), 0862.09m2Organizational.8-09.m (09.06 Network Security Management) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0862.09m2Organizational.8-09.m 09.06 Network Security Management
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
sql_server_use_virtual_service_endpoint - Powerpipe Control:
azure_compliance.control.sql_server_use_virtual_service_endpoint - Azure Policy Definition:
ae5d2f14-d830-42b6-9899-df6cfe9c71a3
Last reviewed: 2026-10-15