It's generally a good idea to avoid exposing public endpoints if it's not required, especially when we talk about management and administration. Exposing the endpoint of your Web App is something you probably want to do, but why expose the database? It will only cause additional security risks and increase the chance of your data being breached. The same goes for management; exposing RDP, SSH, or any other port that can be used to manage and administrate your resources should be avoided.
In case we have a database in IaaS, the best practice is to allow access to the database over port 1433, only inside Azure Vnet, or even limit access to a specific subnet. Use NSGs and Application Security Groups (ASGs) to set up access ...
