We are struggling with this at the moment. We cannot utilise an Azure Private Network (APN) as the Azure SQL Database cannot be placed within it (we were hoping that APN would afford us some internal security in that regard).

The Cloud Service (weblication) uses a URL not an IP address and is not in itself placed within an APN. Therefore it sounds like this set up (Azure - Azure) is not feasible at this moment in time?

So, if the weblication was within an APN, does that mean it WOULD have an external IP which could then be directed to (and given a FW rule) to allow access?