For authentication , the correct choice is Enable a managed identity and use Microsoft Entra authentication . Azure App Service supports managed identity, and Microsoft documents this as the recommended way to connect to Azure SQL Database without passwords or secrets . This minimizes administrative effort because there are no SQL passwords to rotate, store, or manage.

For network access , the correct choice is Create a private endpoint and disable public network access . Microsoft documents that when public network access is disabled , Azure SQL Database only accepts connections through private endpoints . That keeps the database traffic on Azure private networking rather than exposing it through the public endpoint. Microsoft also notes that simply adding a private endpoint does not disable public access by itself, so disabling public network access is part of the correct configuration.

The other options are weaker:

Rotated SQL credentials or storing SQL logins in Key Vault still use passwords and create more admin overhead.

Allowing Azure services, adding outbound IP firewall rules, or database firewall rules still rely on the public endpoint , so they do not best satisfy the requirement that database traffic remain within the subscription.