3.2.1. Azure SQL Platform-Level Security and Auditing
💡 First Principle: Platform-level security for Azure SQL is about closing gaps that exist below the level of any individual query or user permission — how the server itself authenticates, what's encrypted, and whether every access event leaves a durable record.
Key platform configurations include preferring Microsoft Entra authentication over SQL authentication (bringing SQL access under the same Conditional Access and MFA controls covered in Phase 2, rather than a separate password), Transparent Data Encryption (TDE) for encryption at rest, and firewall rules restricting which networks can reach the server — the same network-plus-identity pattern from storage applies here too. Database auditing, configured for both Azure SQL Database and Azure SQL Managed Instance, captures database events (queries, schema changes, permission changes) to a storage account, Log Analytics workspace, or Event Hub for compliance and investigation.
⚠️ Exam Trap: SQL Managed Instance and Azure SQL Database share most security concepts but aren't configured identically — a scenario testing auditing configuration steps for one isn't necessarily describing the correct steps for the other, since Managed Instance's networking model (it sits inside a virtual network by default) differs meaningfully from single-database Azure SQL Database.
Reflection Question: Why does enabling Microsoft Entra authentication for Azure SQL bring database access under Conditional Access policies, when SQL authentication (username/password) does not?
