During virtual network setup, if you use ExpressRoute with network peering to Microsoft, add the following service endpoints to the subnet in which the service will be provisioned:
* Target database endpoint (for example, SQL endpoint, Cosmos DB endpoint, and so on)
* Storage endpoint
* Service bus endpoint
This configuration is necessary because Azure Database Migration Service lacks internet connectivity.
Reference:
https://docs.microsoft.com/en-us/azure/dms/tutorial-sql-server-to-managed-instance

The backend port for the Azure Load Balancer rule must be 1433 (or your configured SQL Server port), while the health probe must monitor port 59999 to successfully route traffic to the active Always On availability group replica.
Reference:
https://multicloudsagar.com/file-server-cluster-in-azure/

A quorum mode is configured at the WSFC cluster level that dictates the methodology used for quorum voting. The Failover Cluster Manager utility will recommend a quorum mode based on the number of nodes in the cluster.
When using an asymmetric storage configuration for Always On availability groups, you should generally use the Node Majority quorum mode when you have an odd number of voting nodes, or the Node and File Share Majority quorum mode when you have an even number of voting nodes.
Reference:
https://learn.microsoft.com/en-us/sql/sql-server/failover-clusters/windows/wsfc-quorum-modes-and-voting-configuration-sql-server

The Encryption keys can only be stored in either Azure Key vault or the windows certificate store.
From the implementation shown below, you can see that these are the sources you can use for storing the encryption keys.

https://docs.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell

Configure Advanced Threat Protection for Azure SQL Database
Advanced Threat Protection for Azure SQL Database detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Advanced Threat Protection can identify Potential *SQL injection*, Access from unusual location or data center, Access from unfamiliar principal or potentially harmful application, and Brute force SQL credentials.
Set up Advanced Threat Protection in the Azure portal
Step 1: Sign into the Azure portal.
Step 2: Navigate to the configuration page of the server you want to protect. [Here sql12345678 ] In the security settings, select Microsoft Defender for Cloud.
Step 3: On the Microsoft Defender for Cloud configuration page:
Step 3a: If Microsoft Defender for SQL hasn't yet been enabled, select Enable Microsoft Defender for SQL.
Step 3b: Select Configure.

Step 3c: Under ADVANCED THREAT PROTECTION SETTINGS, select Add your contact details to the subscription's email settings in Defender for Cloud.

Step 3d: Provide the list of emails to receive notifications upon detection of anomalous database activities in the Additional email addresses (separated by commas) text box. [Skip] Step 3e: Optionally customize the severity of alerts that will trigger notifications to be sent under Notification types. [Skip] Step 3f: Select Save.

Reference:
https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-configure