A web app hosted on Azure App Service must connect to an on-premises SQL Server over TCP 1433. You cannot expose SQL Server publicly, and you do not want to integrate the App Service with an Azure VNet. The on-premises network has outbound internet access. Which steps should you take to enable connectivity?

The correct steps involve using Azure Hybrid Connections. First, you create a Hybrid Connection within your Azure Web App, specifying the on-premises SQL Server's hostname/IP and port (TCP 1433). This defines the target for the connection. Second, you install the Hybrid Connection Manager (HCM) on an on-premises server that has network access to the SQL Server. The HCM establishes an outbound connection to Azure Relay, creating a secure tunnel. This allows the App Service to reach the on-premises SQL Server without exposing the SQL Server publicly or requiring VNet integration for the App Service. Regional VNet Integration with a site-to-site VPN would work but is explicitly excluded by the requirement not to integrate the App Service with an Azure VNet. Exposing SQL Server publicly is disallowed. A Private Endpoint for the App Service would connect the App Service to a private endpoint in Azure, not directly to an on-premises SQL Server.