Question

Your company runs an Azure SQL Database that must be accessed by application servers in an on-premises datacenter connected to Azure via ExpressRoute. Security requires that traffic to the database never traverse the public internet and that the database be reachable using a private IP address from the on-premises network. Which solution should you implement?

Accepted Answer

Create a private endpoint for the Azure SQL Database and configure DNS resolution to the private IP

Answer

Configure a service endpoint for Microsoft.Sql on the application subnet

Answer

Add the on-premises public IP range to the Azure SQL Database server firewall allow list

Answer

Enable a service endpoint policy restricting the SQL server to the ExpressRoute gateway subnet