SQL Server has an auditing policy configured

# Enable server-level auditing to Azure Storage
resource "azurerm_mssql_server_extended_auditing_policy" "<example_resource_name>" {
  server_id                  = "<example_resource_id>"
  storage_endpoint           = "https://<STORAGE_ACCOUNT_NAME>.blob.core.windows.net/" # Critical: audit log destination
  storage_account_access_key = "<STORAGE_ACCOUNT_KEY>"                                  # Critical: allows writing audit logs
}

// Enable server-level auditing to an existing Storage Account
param sqlServerName string = "<example_resource_name>"
param storageAccountName string = "<example_resource_name>"

resource sql 'Microsoft.Sql/servers@2021-11-01' existing = {
  name: sqlServerName
}

resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

resource audit 'Microsoft.Sql/servers/auditingSettings@2021-11-01-preview' = {
  name: 'default'
  parent: sql
  properties: {
    state: 'Enabled' // Critical: turns on auditing
    storageEndpoint: 'https://${sa.name}.blob.core.windows.net/' // Critical: audit log destination
    storageAccountAccessKey: listKeys(sa.id, '2023-01-01').keys[0].value // Critical: grants write access to logs
  }
}