>> In this episode,
we will cover the Deny Public Network Access
setting for Azure SQL Database
and how it compares if you're using
the public endpoint versus the private endpoint to connect.
This week on Data Exposed.
[MUSIC]
>> Welcome back to Data Exposed.
I'm Anna Hoffman, and today I'm joined by Rohit Nayak,
Program Manager on the Azure SQL security team.
Welcome back again, Rohit.
We're so happy to have you here.
>> Thank you, Anna. Happy to be here
and to talk some more about network security features.
>> Awesome. In the last episode that we had you on,
we talked about Azure Private Link for Azure SQL Database,
and today I think you want to break it down for
us how you deny public network access.
>> Correct. So let me share my screen here and bring up a slide.
Where we left off last time was,
customers have the ability now
to connect to SQL Database over private link,
which logically leads to the next question which is, ''Hey,
now I have private connectivity,
how do I shut down public connectivity to my databases?''
For this, we have introduced a new norm,
if you will, at the server level,
it's called Deny public network access,
and you simply switch it to yes,
and it will deny all public access.
Now, it looks simple,
but let me take you through
some subtleties of how it actually works behind the scenes.
So today, when you connect to SQL Database,
this is my SQL Database server here at the bottom,
and then you have an incoming connection from a client,
the default is not denying public network access,
which means this connection goes through
the various network access controls
that we have spoken about in the past.
First, we'll check if, ''Hey,
does this match any VNet firewall rules?''
If not, then I go check against my database level firewall,
and finally, I check against my server level firewall.
So this is how the connection flows through today.
Let me bring up my slide deck here,
and this is the setting that we have introduced at
a server level that allows you to deny public network access.
By doing this, what you are doing is,
you are going exclusively to the use of private endpoint.
Now, it looks very simple here when I show you but let me
take you through how this works in practice.
Today, when you login to your server,
basically, deny public network access is set to no,
which is the default,
and this means that
your connection goes through several different checks.
We'll first check if your login
matches anything that we have in the VNet firewall rules.
If that does not match,
then we check the database level firewall,
and finally, the server level firewall.
So this is how your login is processed today.
With this new setting, what happens if you
choose to set it to yes?
Then your connection goes through a private endpoint,
and then all this other modes of
connecting to the database are taken away.
So that is the big decision that you have to make as a customer,
which is the route you want to choose for
your connections to the database and choose one or the other.
>> Awesome. Thanks, Rohit. That's really interesting.
One thing that I noticed on that slide you showed is that,
now we're server scoped only.
So when we look at private endpoint, just to clarify,
there's no such thing as having
a server level or a database level, is that right?
>> Correct. All these settings are at the server level.
In fact, I will go now demonstrate this with
one of the servers that we've been using for our demos.
So this is my server for which I have private endpoint enabled.
Because this private endpoint,
it's showing us a clue,
what that means is I can now connect to my server,
either databases or Synapse Analytics
workspaces that are hosted under the logical server.
I can connect using this private endpoint,
and this is what we had shown in the previous video.
Here, we are in the portal,
and as you can see,
another firewalls blade, we have this deny settings set to no.
Let me show you what happens when I try to connect to
my database in this state.
I'm just using our favorite sqlcmd utility.
As you can see,
I'm getting an explicit error message here saying that
my client with this IP is not allowed access.
What this means, I'm still coming in via the public endpoint,
and I'm going to the phase
where the firewall rules are being evaluated,
and it's rejecting my connection
because I'm not in the firewall rules.
Now, let's see how this changes when I flip this setting to yes.
>> Now, one question here,
Rohit, is when we flip this to yes,
that means that if we're not using the private endpoint,
we're going to be blocked from connecting.
So is that something we need to be aware of
or are there anything we're working on around that?
>> Yes. That's a good question, Anna.
So this is a very important setting
as far as connectivity is concerned.
We only want customers to set this to
yes when they are using private endpoints.
In fact, we have enhancement coming that will actually block
you from setting this to yes if you
do not have any private endpoint connections.
Essentially, you are disconnecting
all open connections to your database.
So yes, that's a very good point
that you have to do this with care,
and you have to know that all your connections
are first coming in via private endpoint,
and only then cut off public connectivity.
>> Got you.
>> Then you'll see how this changes now.
So I get a different error message.
It says the public network interface is not accessible.
To connect to the server use
private endpoints from inside your VNet.
It's a very clear message telling me that, "Look,
you are trying to connect from
outside but I'm not even going to go evaluate the firewall rules.
I'm just denying your connection
because of this particular setting."
Again, the value add here is you have
already defined private endpoint connectivity,
and with this you explicitly
disallow all other modes of connecting to your database.
So we hope that customers find this useful,
and this gives them confidence in using private endpoints
and improving their security posture overall.
>> Awesome. Thanks, Rohit.
Thanks for this really clear explanation.
I think it's going to help a lot of
our viewers when they're trying to navigate.
Now I set up private endpoint.
How do I deny public network access?
How is that different from what I was
doing before with public endpoint?
So thanks again, Rohit,
for being here with us on the show.
Viewers, we hope you enjoyed this video, and if you did,
please give it a like or a comment or subscribe to
our channel and we hope to see you next time on Data Exposed.
[MUSIC]