title: Defending against Azure SQL data leakage from within a corporate network
body: <p>I have question around DLP (data leakage prevention) from a corporate network.</p>
  
  <p>I have a Virtual Machine on a corporate network. The VM can access an Azure SQL DB in the cloud: aaa.database.windows.net through a connection over port 1433.</p>
  
  <p>However, I don't want that same VM to connect to bbb.database.windows.net.</p>
  
  <p>Azure offers no guarantees on the public IP (both servers could appear as the same IP) - what technology can I use on the corporate's perimeter network/firewall to permit access to aaa but disallow access to bbb?</p>
  
  <p>The attack I am concerned about is someone internal to the company querying data out of aaa and inserting it in to bbb. For example, if the one server is ourcorporatedate.database.windows.net and the other is somerandom.database.windows.net the someone internal to the company could take corporate data and write it to some random database.</p>
  
  <p>Thanks</p>