3.2. Implement Security for Databases

💡 First Principle: Databases hold an organization's most structured, most valuable data in one place, which makes platform-level security (how the database itself is configured) and detection (is something abnormal happening to it) equally non-negotiable — a database with perfect network isolation is still a target if its authentication and auditing aren't equally tight.

Mental model: treat Azure SQL security as the same two-question structure used for storage — is the platform configured correctly (authentication method, auditing enabled, encryption), and is a detection layer watching for the access patterns that configuration alone can't rule out as safe?

⚠️ Common Misconception: Enabling auditing on Azure SQL does not automatically enable threat protection. Auditing logs events for compliance and forensic review; Defender for Databases is a separate, independently-enabled workload protection plan that performs active threat detection — turning one on has no effect on the other.