'Allow access to Azure services' should be disabled for PostgreSQL Servers

What does the recommendation "'Allow access to Azure services' should be disabled for PostgreSQL Servers" check?

Flags any PostgreSQL flexible server that has the 'Allow public access from any Azure service within Azure to this server' option enabled. Behind the scenes that option is a firewall rule named AllowAllAzureServicesAndResourcesWithinAzureIps whose start and end IP are both 0.0.0.0, which permits connections from the entire Azure backbone, not just your own resources. The check looks only at this specific firewall rule. It does not evaluate your named IP allowlist rules, whether public network access is turned off altogether, or whether the server uses VNet integration or a private endpoint, all of which are separate controls.

Why does "'Allow access to Azure services' should be disabled for PostgreSQL Servers" matter?

The 0.0.0.0 rule does not mean 'your Azure resources', it means any IP allocated to any Azure service in any tenant, including virtual machines and functions owned by other customers. An attacker who provisions a cheap Azure resource sits inside that allowed range, so your database firewall effectively trusts the whole cloud. Combined with a weak password, a leaked connection string or SQL injection in an app, this turns a single credential slip into direct data exfiltration. Disabling it forces every connection to come from an IP you have explicitly named or from inside your own virtual network, shrinking the attack surface to something you actually control.

How do I fix "'Allow access to Azure services' should be disabled for PostgreSQL Servers"?

1. In the portal open the server, go to Settings then Networking, and clear the 'Allow public access from any Azure service within Azure to this server' checkbox, then Save.
2. Or with the CLI delete the rule directly: az postgres flexible-server firewall-rule delete --resource-group <rg> --server-name <server> --name AllowAllAzureServicesAndResourcesWithinAzureIps --yes, and add tight rules for the specific IPs you trust with az postgres flexible-server firewall-rule create.
3. To enforce this at scale, assign the built-in Azure Policy by its display name rather than a hardcoded GUID: pid=$(az policy definition list --query "[?displayName=='Public network access should be disabled for PostgreSQL flexible servers'].name" -o tsv); az policy assignment create --name no-azure-services-pg --policy "$pid" --scope <scope>, and prefer private endpoints or VNet integration for application access.

# 1. Lock the wire and the network on a production PostgreSQL flexible server.
RG=db-prod-rg
SRV=ordersprod-pg

# Enforce encrypted connections (dynamic, no restart needed).
az postgres flexible-server parameter set \
  --resource-group "$RG" --server-name "$SRV" \
  --source user-override \
  --name require_secure_transport --value ON

# Pin the minimum TLS version.
az postgres flexible-server parameter set \
  --resource-group "$RG" --server-name "$SRV" \
  --source user-override \
  --name ssl_min_protocol_version --value TLSv1.2

# Disable public network access.
az postgres flexible-server update \
  --resource-group "$RG" --name "$SRV" \
  --public-access Disabled

# 2. Turn on the pgaudit trail and connection throttling.
for p in "pgaudit.log=role,ddl,misc" \
         "pgaudit.log_client=ON" \
         "pgaudit.log_level=log" \
         "pgaudit.log_statement=on" \
         "pgaudit.log_statement_once=on" \
         "connection_throttle.enable=on"; do
  az postgres flexible-server parameter set \
    --resource-group "$RG" --server-name "$SRV" \
    --source user-override \
    --name "${p%%=*}" --value "${p#*=}"
done

# 3. Provision a Microsoft Entra administrator and disable password sign-in.
az postgres flexible-server ad-admin create \
  --resource-group "$RG" --server-name "$SRV" \
  --display-name "dba-team" \
  --object-id "$(az ad group show --group dba-team --query id -o tsv)" \
  --type Group
az postgres flexible-server update \
  --resource-group "$RG" --name "$SRV" \
  --microsoft-entra-auth Enabled --password-auth Disabled

# 4. Ratchet it shut: deny any future PostgreSQL flexible server with public access.
# Look the built-in policy up by its EXACT display name, never paste a guessed GUID.
PID=$(az policy definition list \
  --query "[?displayName=='Public network access should be disabled for PostgreSQL flexible servers'].name" \
  -o tsv)
az policy assignment create \
  --name deny-public-pg-flex \
  --policy "$PID" \
  --params '{"effect":{"value":"Deny"}}' \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"