Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Managed identity lets an App Service authenticate to Azure SQL without carrying a database password. The Azure identity, database user mapping, least-privilege grants, and network path must all line up before the connection succeeds.
I would enable managed identity for the App Service, create a database user for that identity in Azure SQL, and grant only the permissions the API needs. In the connection string I would use Microsoft Entra authentication for managed identity rather than a SQL username and password. The .NET code still uses normal SQL client or EF Core patterns, but authentication comes from the platform identity instead of a stored secret.