TopolearnAzure SQL is the default relational database for many Azure apps, and its options change cost and resilience.
Azure SQL Database is a fully managed SQL Server engine (T-SQL) with patching, backups and high availability built in. A logical server (<name>.database.windows.net) is a management and login endpoint that holds one or more databases.
Purchasing models:
- vCore (recommended): choose General Purpose, Business Critical (local SSD replicas, read scale-out) or Hyperscale (storage up to 128 TB, fast scaling, named replicas). Serverless compute in General Purpose and Hyperscale auto-scales and can auto-pause when idle, which suits dev and spiky workloads.
- DTU: older bundled tiers (Basic, Standard, Premium).
- Elastic pools share compute between many databases, as in SaaS per-tenant databases.
Point-in-time restore works from automatic backups, and zone redundancy is a checkbox in most tiers. For regional DR, failover groups replicate to another region and give a stable listener name.
Security: use Microsoft Entra-only authentication and managed identities; contained database users are created with CREATE USER [name] FROM EXTERNAL PROVIDER. Restrict access with firewall rules or, better, private endpoints. Azure SQL Managed Instance exists for near-100% SQL Server compatibility (SQL Agent, cross-database queries) when lifting and shifting.
Example
-- az sql db create -g rg-data -s sql-orders -n ordersdb \
-- --edition GeneralPurpose --compute-model Serverless \
-- --family Gen5 --capacity 2 --auto-pause-delay 60
-- Run as the Entra admin, inside ordersdb:
CREATE USER [orders-api] FROM EXTERNAL PROVIDER; -- the app's managed identity name
ALTER ROLE db_datareader ADD MEMBER [orders-api];
ALTER ROLE db_datawriter ADD MEMBER [orders-api];
CREATE TABLE dbo.Orders (
Id INT IDENTITY PRIMARY KEY,
Customer NVARCHAR(100) NOT NULL,
Total DECIMAL(10,2) NOT NULL,
CreatedAt DATETIME2 NOT NULL DEFAULT SYSUTCDATETIME()
);
-- App connection string: no password
-- Server=tcp:sql-orders.database.windows.net;Database=ordersdb;Authentication=Active Directory Managed Identity;Remember
- Logical server = endpoint; databases are billed separately
- vCore tiers: General Purpose, Business Critical, Hyperscale; serverless can auto-pause
- Use Entra-only auth and managed identities as database users
- Failover groups give cross-region DR with a stable name
Watch out for
- Leaving the "Allow Azure services" firewall exception on, which admits traffic from any Azure customer's resources.