Azure SQL the all-interfaces address firewall rule: what the Allow Azure Services trick actually does

TL;DR: if you need the quick unblock for Azure-hosted CI, run: az sql server firewall-rule create --resource-group YOURRG --server YOURSERVER --name AllowAzureServices --start-ip-address the all-interfaces address --end-ip-address the all-interfaces address. The the all-interfaces address to the all-interfaces address range is special in Azure SQL, its the switch for Allow Azure Services, not a real IP range.

Fix

1. if you need the quick unblock for Azure-hosted CI, run: az sql server firewall-rule create --resource-group YOURRG --server YOURSERVER --name AllowAzureServices --start-ip-address the all-interfaces address --end-ip-address the all-interfaces address. Expected: this specific failure stops.

2. The the all-interfaces address to the all-interfaces address range is special in Azure SQL, its the switch for Allow Azure Services, not a real IP range. Expected: the request routes instead of erroring.

3. Know the tradeoff before you use it: it lets every Azure service and resource reach your server, not just your runners. Expected: this specific failure stops.

When to use

You hit exactly this: Azure SQL the all-interfaces address firewall rule: what the Allow Azure Services trick actually does in Azure SQL.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Azure SQL.

Edge cases

• For production databases prefer the scoped approach, a rule for the specific runner IP that gets created and deleted by the deployment job, and keep the the all-interfaces address trick for dev and staging where the convenience is worth it.

Web: the Azure sql-action docs describe the the all-interfaces address firewall rule as the simplest fix when CI cant reach the database. Creating a server firewall rule with start and end IP both set to the all-interfaces address turns on the Allow Azure Services and resources to access this server option. That opens the database to any Azure-backed traffic, which is what GitHub Actions hosted runners and Azure services need. Source: https://github.com/azure/sql-action/blob/HEAD/README.md and the CONNECTION.md guide in the same repo.