How to find SQL servers open to the internet in Azure

Install-Module -Name Az.Accounts, Az.ResourceGraph, Az.Sql -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptionIds = @(
        Get-AzSubscription |
        Where-Object State -eq 'Enabled' |
        Select-Object -ExpandProperty Id
    )
    if ($subscriptionIds.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $query = @(
        'Resources'
        '| where type =~ "microsoft.sql/servers"'
        '| project id, name, subscriptionId, resourceGroup,'
        '    serverName = tostring(properties.fullyQualifiedDomainName),'
        '    publicAccess = tostring(properties.publicNetworkAccess),'
        '    minimumTls = tostring(properties.minimalTlsVersion),'
        '    entraOnly = tobool(properties.administrators.azureADOnlyAuthentication),'
        '    entraAdmin = tostring(properties.administrators.login)'
        '| order by publicAccess desc, id asc'
    ) -join ' '
    function Get-AzGraphRows {
        param([string]$Query, [string[]]$SubscriptionIds)
        $results = [System.Collections.Generic.List[object]]::new()
        $skipToken = $null
        do {
            $arguments = @{
                Query = $Query
                Subscription = $SubscriptionIds
                First = 1000
            }
            if ($skipToken) { $arguments.SkipToken = $skipToken }
            $page = Search-AzGraph @arguments
            foreach ($record in $page.Data) { $results.Add($record) }
            $skipToken = $page.SkipToken
        } while ($skipToken)
        return $results.ToArray()
    }
    $servers = @(Get-AzGraphRows -Query $query -SubscriptionIds $subscriptionIds)
    if ($servers.Count -eq 0) {
        Write-Output 'No SQL servers were found in the readable subscriptions.'
        return
    }
    $rows = @(foreach ($server in $servers) {
        $rules = $null
        try {
            Set-AzContext -SubscriptionId $server.subscriptionId | Out-Null
            $ruleArguments = @{
                ResourceGroupName = $server.resourceGroup
                ServerName = $server.name
            }
            $rules = @(Get-AzSqlServerFirewallRule @ruleArguments)
        } catch {
            Write-Warning "Rules not read for $($server.name): $($_.Exception.Message)"
        }
        $ruleCount = 'Not read'
        $everyAddress = 'Not read'
        $azureServices = 'Not read'
        if ($null -ne $rules) {
            $wide = @($rules | Where-Object {
                $_.StartIpAddress -eq '0.0.0.0' -and $_.EndIpAddress -eq '255.255.255.255'
            })
            $azureOnly = @($rules | Where-Object {
                $_.StartIpAddress -eq '0.0.0.0' -and $_.EndIpAddress -eq '0.0.0.0'
            })
            $ruleCount = $rules.Count
            $everyAddress = if ($wide.Count -gt 0) { 'Yes' } else { 'No' }
            $azureServices = if ($azureOnly.Count -gt 0) { 'Yes' } else { 'No' }
        }
        $entraOnly = if ($server.entraOnly) { 'Yes' } else { 'No' }
        $entraAdmin = if ($server.entraAdmin) { $server.entraAdmin } else { 'None' }
        [pscustomobject]@{
            ServerName          = $server.serverName
            SubscriptionId      = $server.subscriptionId
            ResourceGroup       = $server.resourceGroup
            PublicNetworkAccess = $server.publicAccess
            MinimumTls          = $server.minimumTls
            EntraOnlySignIn     = $entraOnly
            EntraAdministrator  = $entraAdmin
            FirewallRules       = $ruleCount
            OpenToEveryAddress  = $everyAddress
            AzureServicesAllowed = $azureServices
        }
    })
    $rows | Sort-Object OpenToEveryAddress -Descending |
        Export-Csv -Path './sql-servers.csv' -NoTypeInformation -Encoding utf8
    $open = @($rows | Where-Object OpenToEveryAddress -eq 'Yes')
    $public = @($rows | Where-Object PublicNetworkAccess -eq 'Enabled')
    Write-Output "$($rows.Count) SQL servers saved to sql-servers.csv."
    Write-Output "$($open.Count) have a firewall rule open to every address."
    Write-Output "$($public.Count) have public network access enabled."
} finally {
    Disconnect-AzAccount | Out-Null
}