Protecting Azure SQL against unauthorized user access

Preventing unauthorized network connections may be the first layer of security for Azure SQL databases but clients still need to be authenticated and authorized before they can gain access. Authentication validates the identity of the client that is requesting access while authorization validates the operations that an identity can perform in a SQL database. Azure SQL Database supports two types of authentication: SQL authentication and Azure Active Directory (Azure AD) authentication.

SQL authentication uses a username and password that is stored in the master database (for server-wide access) or individual databases. When a new SQL logical server is created in Azure, we need to specify a local server admin credential. This credential is referred to as the server admin account. This account can authenticate to any database on that server as the database owner. We can use the initial server admin account to create additional...