Azure Policy - SQL FW whitelist validator

{
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Sql/servers/firewallRules"
      },
      {
        "anyOf": [
          {
            "field": "Microsoft.Sql/servers/firewallRules/startIpAddress",
            "notin": "[parameters('allowedAddressRanges')]"
          },
          {
            "field": "Microsoft.Sql/servers/firewallRules/endIpAddress",
            "notin": "[parameters('allowedAddressRanges')]"
          }
        ]
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}