Question

Your company runs a set of VMs in a spoke virtual network that must access an Azure SQL Database. Security requires that traffic to the database stay on the Microsoft backbone and that the database be reachable using a private IP address from the VNet address space, so that on-premises clients connected over ExpressRoute private peering can also reach it through the same private IP. Which connectivity option meets all of these requirements?

Accepted Answer

Create a private endpoint for the Azure SQL Database in the spoke VNet and integrate it with a private DNS zone.

Answer

Enable a service endpoint for Microsoft.Sql on the VM subnet and add the subnet to the SQL server firewall's virtual network rules.

Answer

Create a service endpoint policy scoped to the SQL server and apply it to the VM subnet.

Answer

Configure the SQL server public endpoint with an IP firewall rule that allows only the ExpressRoute peering address range.