Azure SQL the all-interfaces address firewall rule: what the Allow Azure Services trick actually does

if you need the quick unblock for Azure-hosted CI, run: az sql server firewall-rule create --resource-group YOURRG --server YOURSERVER --name AllowAzureServices --start-ip-address the all-interfaces address --end-ip-address the all-interfaces address. The the all-interfaces address to the all-interfaces address range is special in Azure SQL, its the switch for Allow Azure Services, not a real IP range. Know the tradeoff before you use it: it lets every Azure service and resource reach your server, not just your runners. For production databases prefer the scoped approach, a rule for the specific runner IP that gets created and deleted by the deployment job, and keep the the all-interfaces address trick for dev and staging where the convenience is worth it.

Web: the Azure sql-action docs describe the the all-interfaces address firewall rule as the simplest fix when CI cant reach the database. Creating a server firewall rule with start and end IP both set to the all-interfaces address turns on the Allow Azure Services and resources to access this server option. That opens the database to any Azure-backed traffic, which is what GitHub Actions hosted runners and Azure services need. Source: https://github.com/azure/sql-action/blob/HEAD/README.md and the CONNECTION.md guide in the same repo.