When creating an Azure SQL environment you will get a public IP address where you have to connect to. You can secure this using a Network Security Group (NSG), but a lot of customer are not too happy with this, and they want to access Azure SQL via the Virtual Network. When you have a Site-to-Site VPN connection between your on-premises environment and Microsoft Azure, you should be able to connect to Azure SQL this way.
Microsoft is aware of this is start now offering Azure SQL VNET Endpoints (as of October 2017 in Public Preview), which makes it possible to connect to Azure SQL via your Virtual Network infrastructure.
Note. This feature can only be used in Azure Resource Manager (ARM) Virtual Networks. ‘Classic’ Virtual Networks cannot be used.
More information regarding this feature can be found in the “Use Virtual Network service endpoints and rules for Azure SQL Database” article on https://docs.microsoft.com/en-us/azure/sql-database/sql-database-vnet-service-endpoint-rule-overview