Question

You manage an NSG applied to a subnet that hosts application servers. The security team requires that these servers can reach Azure SQL Database in the same region for outbound connections, but all other outbound Azure and internet traffic must be blocked. You want the rule to remain valid even as Microsoft periodically changes the underlying IP address ranges for the SQL service. Which outbound rule configuration should you use?

Accepted Answer

Create an Allow rule with destination service tag Sql.<Region> at a lower priority number, then a Deny rule to destination service tag Internet at a higher priority number.

Answer

Create an Allow rule listing the current published SQL IP ranges as destination, then a Deny rule to destination Any.

Answer

Create an Allow rule with destination service tag Sql (global), then a Deny rule to destination service tag AzureCloud.

Answer

Create a single Allow rule with destination service tag Sql.<Region> and rely on the default outbound rules to block everything else.