Protecting Azure SQL against unauthorized network connections

When an Azure SQL database instance is created, it is deployed into an Azure SQL logical server. The logical server acts as the administrative frontend for SQL databases. As shown in Figure 11.4, one logical server can contain multiple SQL databases and elastic pool databases:

Figure 11.4 – Azure SQL components

To protect data in our SQL databases, we should only allow access from trusted and necessary clients. Here are some ways to control network access to Azure SQL databases.

Implementing IP firewall rules

By default, a logical SQL server has a public endpoint that is reachable on the public internet using the DNS name in the following format:

<unique_server_name>.yourservername.database.windows.net. 

Clients can use this endpoint to connect to databases contained in the server. Azure SQL Database has a built-in firewall that can be used to define trusted network...