Q. Can Azure SQL Database be created on an Azure Virtual Network?
A. No and typically this is not required since it is an application connecting to the database rather than the database connecting to an application. The Azure SQL Database has a DNS name which by default is blocked for access through its firewall and access has to be enabled for IP addresses utilizing (from the Internet) and/or from all services in Azure itself. Note that the enabling of access simply enables the connection, any authorization still has to be passed meaning only valid users can actually utilize the service. When an Azure SQL Database instance is accessed from an Azure service the access is through the internal Azure network and not via the Internet.
Note that when you define the firewall rules you can define them at a server and database level. While the term server is used this simply refers to all the databases within the same plan as all the databases don't run on the same instances.
