Question

You manage an Azure SQL Database that hosts sensitive HR data. Company policy requires that the database be reachable only from an existing subnet that hosts the application virtual machines, while blocking all other Azure and internet traffic. You want to enforce this network restriction without provisioning a private endpoint and without allowing public IP-based access. Which configuration meets the requirement with the least administrative overhead?

Accepted Answer

Create a virtual network rule on the SQL Database logical server that references the application subnet with the Microsoft.Sql service endpoint enabled.

Answer

Add a server-level firewall rule with the start and end IP addresses set to the public IPs of the application VMs.

Answer

Enable the 'Allow Azure services and resources to access this server' setting on the logical server.

Answer

Create a database-level firewall rule scoped to the HR database using the sp_set_database_firewall_rule stored procedure.