Azure SQL Database

Learning objectives#

• Create a logical server and database
• Choose serverless or provisioned compute
• Secure access with firewall rules and Entra ID
• Connect from an ASP.NET Core app

Explanation#

You create a logical server (a connection endpoint and security boundary) and one or more databases on it.

Purchasing models: DTU (simple bundles) and vCore (choose CPU and memory). The serverless vCore tier auto-pauses when idle — ideal for dev and low-traffic apps.

Networking: by default no one can connect. Add firewall rules for specific IPs, allow Azure services, or use private endpoints for the most secure setup.

Prefer Microsoft Entra authentication (and managed identities for apps) over SQL logins with passwords.

Code example: A serverless dev database#

1az sql server create -n sql-shop-dev -g rg-shop-dev -l centralindia \
2  --enable-ad-only-auth --external-admin-principal-type User \
3  --external-admin-name asha@example.com --external-admin-sid <object-id>
4

5az sql db create -n shopdb -s sql-shop-dev -g rg-shop-dev \
6  --edition GeneralPurpose --family Gen5 --capacity 2 \
7  --compute-model Serverless --auto-pause-delay 60
8

9az sql server firewall-rule create -g rg-shop-dev -s sql-shop-dev \
10  -n my-laptop --start-ip-address <your-ip> --end-ip-address <your-ip>
11

12# appsettings: Server=tcp:sql-shop-dev.database.windows.net;Database=shopdb;
13#              Authentication=Active Directory Default;Encrypt=True;

The database is online. With the connection string above, EF Core or SqlClient authenticates with your Azure sign-in locally and with managed identity in App Service.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

1. The server uses Entra-only authentication — no SQL passwords exist.
2. Serverless General Purpose with 2 vCores auto-pauses after 60 minutes idle.
3. A firewall rule allows only your IP.
4. “Active Directory Default” in the connection string uses DefaultAzureCredential behind the scenes.

Real-world use case#

Common mistakes#

Best practices#

• Use Entra-only authentication and managed identity
• Use private endpoints in production
• Use serverless for dev/test
• Test point-in-time restore before you need it

Remember this#

Practice exercise#

1az sql db restore -g rg-shop-dev -s sql-shop-dev -n shopdb --dest-name shopdb-restored --time "<UTC time one hour ago, e.g. 2026-10-29T09:00:00Z>"

Mini quiz#

Want more? Practise all Microsoft Azure MCQs · Microsoft Azure interview questions

Related topics#

My notes#

Saved in this browser.