Forum Discussion
Azure SQL Firewall / Locks
Hi there,
I have 2 environments. I'm more of admin on Azure environment (recently made as subscription admin)
after which
Dev issue - Azure SQL
I'm having difficulty to remove IP from Azure SQL Firewall. (Earlier i was able to) today my manager granted me subscription admin and as SQL Security Manager and it still not able to remove grayed out IPs.
1 Reply
SQL Security Manager is normally sufficient for server-level Azure SQL firewall rules, so greyed-out controls usually point to assignment scope or a higher-level restriction rather than a SQL login problem.
On the logical SQL server, open Access control (IAM) and use Check access to confirm the role is active at the server, resource group, or subscription scope. A new assignment can require a portal refresh or signing out and back in. Then check Locks on the SQL server, resource group, and subscription. A ReadOnly lock blocks changes, while a Delete lock can block deletion of the firewall-rule child resource even when RBAC allows it. Also check for inherited deny assignments or policy restrictions.
Make the change from the logical server’s Networking page, not an individual database. If the portal remains disabled, try deleting the rule with Azure CLI or PowerShell; the returned error and Activity Log usually reveal the missing action or inherited lock. Database-level firewall rules are separate and must be managed with T-SQL.
