Security — networking, Entra authentication, managed identity, encryption, auditing — Azure Databases — Azure SQL, Managed Instance, Cosmos DB, PostgreSQL and Migration

3. Security — networking, Entra authentication, managed identity, encryption, auditing

Intermediate★ Must knowLesson 3 of 9

Network: server-level and database-level firewall rules (allowed IP ranges), "Allow Azure services" switch (broad — prefer narrower options), private endpoints (database gets a private IP in your VNet; public access disabled), VNet service endpoints.

Authentication: SQL logins, or Microsoft Entra ID users/groups and managed identities (recommended — no passwords). Entra-only authentication can be enforced.

sql

-- In the user database, as the Entra admin: create a user for the App Service's managed identity
CREATE USER [shop-api-prod] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [shop-api-prod];
ALTER ROLE db_datawriter ADD MEMBER [shop-api-prod];

json

// appsettings.json in the App Service — no password anywhere
"ConnectionStrings": { "Shop": "Server=tcp:shop-sql.database.windows.net,1433;Database=Shop;Authentication=Active Directory Default;Encrypt=True;" }

Active Directory Default uses the managed identity in Azure and your Visual Studio/Azure CLI login locally (via DefaultAzureCredential).

Data protection:

Feature	Protects
TLS (Encrypt=True)	Data in transit
TDE (Transparent Data Encryption) — on by default	Data files and backups at rest (service-managed or customer-managed keys in Key Vault)
Always Encrypted (with secure enclaves)	Sensitive columns encrypted in the client driver — even DBAs can't see plaintext
Dynamic Data Masking	Hides values from non-privileged users in query results (not encryption)
Row-Level Security	Users see only their rows (multi-tenant filters)
Auditing, Microsoft Defender for SQL	Audit logs, vulnerability assessment, threat detection (SQL injection, unusual access)
Ledger	Tamper-evident tables