Secure Storage, Databases, and Networking · Topic 2 of 3
Database Security for Azure SQL
SC-500 database security: Azure SQL authentication and firewall, encryption with TDE and Always Encrypted, auditing, and Defender for Databases.
- 4 min
- Entra authentication, Entra-only mode, firewall rules, private endpoints, minimum TLS.
- TDE (at rest, on by default), Always Encrypted (client-side columns), dynamic data masking (results only), ledger (tamper evidence).
- Auditing to Storage, Log Analytics or Event Hubs, at server or database level.
What it is
Databases hold the most sensitive data. For SC-500 you secure Azure SQL Database and Azure SQL Managed Instance at the platform level, configure auditing, and turn on Microsoft Defender for Databases across Azure database services.
How it works
Platform-level security
| Control | What it does |
|---|---|
| Microsoft Entra authentication | Users and apps sign in with Entra identities; Microsoft Entra-only authentication disables SQL logins |
| Server firewall rules | Allow specific IP ranges; deny everything else |
| Virtual network rules and private endpoints | Restrict access to your network; disable public network access |
| Minimum TLS version | Require modern TLS for connections |
| Transparent data encryption (TDE) | Encrypts data at rest; on by default; can use a customer-managed key in Key Vault |
| Always Encrypted | Encrypts sensitive columns in the client driver, so plaintext isn't exposed to the database engine (with secure enclaves, only inside the enclave) |
| Dynamic data masking | Hides sensitive values in query results for non-privileged users |
| Ledger | Makes tables tamper-evident with cryptographic proof |
Azure roles such as SQL Server Contributor and SQL Security Manager manage servers and their security settings through Azure; permissions inside the database come from database users and roles.
Auditing
Auditing records database events to an audit log.
| Setting | Notes |
|---|---|
| Scope | Server-level auditing applies to all databases on the server; database-level auditing can add more |
| Destinations | Azure Storage, a Log Analytics workspace or Event Hubs |
| Retention | Set retention for storage destinations |
| Managed Instance | Auditing is configured on the instance, with similar destinations |
If server auditing is on, it always applies to every database; enabling database auditing as well audits the database twice. Microsoft recommends server-level auditing only, unless one database needs a different destination, retention or set of audited events.
Microsoft Defender for Databases
Defender for Databases is a set of Defender for Cloud plans covering:
- Azure SQL databases and SQL Managed Instance,
- SQL servers on machines,
- open-source relational databases (Azure Database for PostgreSQL and MySQL flexible servers, plus supported Amazon RDS engines),
- Azure Cosmos DB.
For Azure SQL and SQL servers on machines it provides vulnerability assessment (misconfigurations and excessive permissions) and advanced threat protection alerts, such as potential SQL injection, access from an unusual location and suspected brute-force attacks. The open-source and Cosmos DB plans provide threat protection alerts.
A worked example: a finance database must allow only Entra sign-ins, stay private, keep card numbers unreadable even to DBAs, and log every query to the SIEM. Enable Entra-only authentication, add a private endpoint and disable public access, use Always Encrypted for the card column, and send audit logs to the Log Analytics workspace used by Microsoft Sentinel.
TDE protects data at rest from someone who gets the files. Always Encrypted protects sensitive columns even from database administrators.
How the exam asks about this
- "Disable SQL authentication on a server." Turn on Microsoft Entra-only authentication.
- "DBAs must not see credit card numbers." Always Encrypted on that column.
- "Get alerts for SQL injection attempts." Defender for Azure SQL.
What to remember for the exam
- Entra authentication, Entra-only mode, firewall rules, private endpoints, minimum TLS.
- TDE (at rest, on by default), Always Encrypted (client-side columns), dynamic data masking (results only), ledger (tamper evidence).
- Auditing to Storage, Log Analytics or Event Hubs, at server or database level.
- Defender for Databases covers Azure SQL, SQL on machines, open-source relational databases and Cosmos DB.
- Vulnerability assessment (SQL) plus threat protection alerts.
Dynamic data masking is not encryption. Users with enough permissions can still see the real data.
Common mistakes
Choosing TDE to hide data from DBAs. Use Always Encrypted.
Treating masking as protection against privileged users. It only hides results for non-privileged users.
Enabling server and database auditing to the same place without thought. You get duplicate records.
Check yourself
Which feature keeps column data encrypted even from the database engine?
Always Encrypted.
Where can Azure SQL audit logs be sent?
Azure Storage, a Log Analytics workspace or Event Hubs.
Name two things Defender for Azure SQL provides.
Vulnerability assessment and advanced threat protection alerts, such as SQL injection detection.
Topic 2 of 3 in Secure Storage, Databases, and Networking
Test yourself on Secure Storage, Databases, and Networking
The full Microsoft SC-500 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.