Azure SQL Firewall

Hi AJAJ ,

Grayed-out IPs in Azure SQL Firewall typically indicate server-level firewall rules that were created by the server-level principal login. According to Microsoft documentation, only the server-level principal login—the account created during the initial provisioning of the SQL server—can delete these rules using sp_delete_firewall_rule
Refer-

https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-delete-firewall-rule-azure-sql-database?view=azuresqldb-current

Even with Subscription Admin and SQL Security Manager roles, you won’t have access to delete these rules unless:

• You are logged in as the server-level principal login, or
• You are assigned as a Microsoft Entra  admin for the SQL server

Therefore you can follow these steps-

1. Confirm whether you are the server-level principal login or request access from whoever is.
2. If you’re not, ask your Azure admin to assign you as a Microsoft Entra admin for the SQL server.
3. Remove the resource group lock if you have the necessary permissions or request it from someone who does.

Hope this helps!

 Hi AJAJ ,

( To get full of Azure SQL but dont want my ID to be as admin unnecessarily to avoid any unknown breaches )
You will  need either the Owner or Contributor role at server-level.

To  regain the ability to manage those grayed-out IPs:

Try connecting to the master database in SSMS and run:

EXEC sp_delete_firewall_rule @name = N'YourRuleName';

If you get an error like “User must be in the master database,” you're not the principal login.
Your current role change may have revoked or overridden that access.
To answer-

What do I need to do for full control of resource group. Azure SQL DB is within that RG?

If the RG is locked, only users with delete or write permissions can remove or modify the lock.

You can assign yourself the necessary roles using Azure RBAC:

Go to the RG in Azure Portal

Navigate to Access Control (IAM)

Click Add Role Assignment

Select either Owner or Contributor

Refer - https://learn.microsoft.com/en-us/azure/role-based-access-control/

Hope this helps!