Azure SQL Firewall / Locks

SQL Security Manager is normally sufficient for server-level Azure SQL firewall rules, so greyed-out controls usually point to assignment scope or a higher-level restriction rather than a SQL login problem.

On the logical SQL server, open Access control (IAM) and use Check access to confirm the role is active at the server, resource group, or subscription scope. A new assignment can require a portal refresh or signing out and back in. Then check Locks on the SQL server, resource group, and subscription. A ReadOnly lock blocks changes, while a Delete lock can block deletion of the firewall-rule child resource even when RBAC allows it. Also check for inherited deny assignments or policy restrictions.

Make the change from the logical server’s Networking page, not an individual database. If the portal remains disabled, try deleting the rule with Azure CLI or PowerShell; the returned error and Activity Log usually reveal the missing action or inherited lock. Database-level firewall rules are separate and must be managed with T-SQL.