There should be a better way for us to secure the communication from Finance and Operations to Azure SQL or Azure Data Lake. Currently the communication happens over the default port 1433, and although we are able to configure a network security group (NSG) to the IP range for the Azure Region in which our F&O is is hosted. Although this removes the public threat, this leaves crucial business data open to threats originating from within Azure. For example, if any virtual machine is compromised within Azure and runs an exploit against the Azure SQL/Data Lake it may gain access. The alternative would be a way to limit access to just our F&O instance to greatly limit the threat. Azure supports such access using VNET peering or VPNs.

https://dagfileshare01.blob.core.windows.net/public-blob-dag-calafell/FO to ASQL.png

Please provide a better way to secure critical business data.