This setting affects the way the plan is created based on a number of engine factors.

If your Business Central database is running on Azure SQL Database or SQL Server 2016 or later, set the database's compatibility level to match the database server. This will equip the database with the latest optimization features of Azure SQL Database or SQL Server. This is particularly relevant for demonstration databases that are installed by using the Business Central Setup because the default compatibility level matches SQL Server 2014.

https://docs.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/optimize-sql-set-compatibility-level

Scope Assignment is an answer to the question “Where can it be done?”

https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Executing a T-SQL statement is the only way to create a database firewall rule.

https://docs.microsoft.com/en-us/sql/integration-services/control-flow/execute-t-sql-statement-task?view=sql-server-ver15

SQL Server has two types of databases: system and user. System databases are the ones used by SQL Server such as master and msdb. User databases are the ones created by users that store the data for applications. Both are important to account for when devising a backup and recovery plan. The nature of most system databases is that they are updated less frequently, although there are exceptions.

As a general rule of thumb, system databases are not restored from one SQL Server instance to another. Your main concern should be backing up the user databases.

The most common types of backups generated for SQL Server installations are:

• Full

• Differential

• Transaction log

Depending on the deployment method, not all of these may be available as an option.

A full database backup is a backup of a single database. When the backup is made, all the pages from the database are copied to the backup device. The backup contains enough information so that you can restore the database to the point at which the backup was made. If you want to restore to a specific point-in-time to achieve your RPO, that can happen with the use of differential and/or transaction log backups. full backup does not flush (or back up) the transaction log. Only a transaction log backup does that and is discussed below.

A differential backup contains all the database pages that have changed since the last time a full backup was made.

A transaction log backup is not only used to be able to achieve RPO and get to a more granular point in time but clears the transaction log and keeps its size manageable. Transaction log backups can be generated as frequently as every 30 seconds, although that is impractical.

There are other backup options such as copy-only, file, filegroup, partial, and more.

A differential or a log backup can be restored after a full database is restored, as long as the database RESTORE command uses either the WITH NORECOVERY or the WITH STANDBY option. If neither option is used, the database RESTORE will do a recovery of the database, after which no additional backups can be applied.

Every SQL Server database uses one of three recovery models: FULL, BULK_LOGGED, or SIMPLE. The recovery model is set as a database option, and governs the type of backups and restores that could be used with the database. Most databases are set to FULL or SIMPLE. FULL allows all types of backups to be generated while SIMPLE does not allow transaction log backups. This means that if you have a smaller RPO, SIMPLE may not meet your needs as you cannot restore to a granular point in time.

https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/backup-restore

One nice thing about the backups is that there is no cost; if a server is provisioned with 100 GB of storage, you get the equivalent amount of backup space included with what you are already paying.

https://docs.microsoft.com/en-us/azure/mysql/concepts-pricing-tiers

Control allows the user to drop or modify an object.

https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

Azure provides three main options to enhance availability for IaaS deployments:

• Availability Sets

• Availability Zones

• Azure Site Recovery

All three of these options are external to the virtual machine (VM) and do not know what kind of workload is running inside of it.

Azure Site Recovery

Azure Site Recovery provides enhanced availability for VMs at the Azure level and can work with VMs hosting SQL Server. Azure Site Recovery replicates a VM from one Azure region to another to create a disaster recovery solution for that VM. As noted earlier, this feature does not know that SQL Server is running in the VM and knows nothing about transactions. While Azure Site Recovery may meet RTO, it may not meet RPO since it is not accounting for where data is inside SQL Server. Azure Site Recovery has a stated monthly RTO of two hours. While most database professionals may prefer to use a database-based method for disaster recovery, Azure Site Recovery works well if it meets your RTO and RPO needs.

https://docs.microsoft.com/en-us/azure/architecture/example-scenario/infrastructure/iaas-high-availability-disaster-recovery

A common technique to look at a SQL Server deployment is to examine a list of active requests. Just like SQL Server, you can use sys.dm_exec_requests to view currently running SQL requests.

Using sys.dm_exec_requests for Azure SQL Database is different from using it for SQL Server or SQL Managed Instance. This DMV shows only active requests related to your database, including background tasks (or background tasks that don't have a database context that shows up as "master"). This is because of the nature of an Azure SQL Database deployment where each database is deployed on its own SQL Server instance.

https://docs.microsoft.com/en-us/learn/modules/azure-sql-deploy-configure/4-exercise-verify-database

Azure SQL Database

Azure SQL Database is contained by a Logical database server. In most cases, a SQL database is hosted by a dedicated SQL Server instance, but you don't have to worry about managing the instance.

The logical database server gives you something to connect to. It also enables you to group and manage certain permissions and configurations together. Within each logical database server is a logical master database, which can provide instance-level diagnostics.

https://azuremarketplace.microsoft.com/en-us/marketplace/apps/Microsoft.SQLServer?tab=Overview

It is important to consider encryption both for data at rest, and data in transit.

Encryption at rest

It is important to understand exactly what encryption at rest entails. Encryption at rest does not encrypt data at the table or column level. Anyone with the appropriate permissions can read the data, copy the data and even share the data. Encryption at rest provides protection against someone restoring a backup to an unsecured server or making a copy of all the database and transaction log files and attaching them to another unsecured server.

Transparent data encryption

Microsoft SQL Server’s Transparent Data Encryption (TDE) encrypts all the data within a target database at the page level. The data is encrypted as the data is written to the data page on disk and decrypted when the data page is read into memory. The end result is that all data pages on disk are encrypted. A database file is not readable by someone who is not authorized. Database backups will also be encrypted, because a backup operation just copies the data pages from the database file to the backup device. No decryption is done during the backup operation.

With Azure SQL Database, enabling TDE is simple. Databases that are created in Azure SQL Database after May 2017 have TDE enabled automatically. Databases that were created before May 2017 will have TDE disabled by default and TDE will need to be manually enabled on these databases. When using Azure SQL Managed Instance, databases that were created after February 2019 have TDE enabled. Databases created before February 2019 will have TDE disabled. Enabling TDE within an Azure SQL Database database is simply a matter of editing the database within the Azure portal. From the “Transparent Data Encryption” pane, select to enable data encryption.

https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest