[300bps]

With Windows Azure SQL Databases, it by default has no ability to be accessed from the public Internet. It is trivial (i.e. 10 seconds work) to add an IP address and a specified port to allow access though.

Sure, it's a hole in the firewall but it's limited to a specific IP address, on a non-standard port, protected by a strong password.

[goofygrin]

SQL Azure != SQL Server running in my clients network.

Say I've got a medical or heavy industrial client. They're not going to be very likely to push their production databases (or even snapshots frankly) into the cloud simply for this product (honestly they all have zero desire to push their data into the cloud as the majority of them have heavily invested in infrastructure over the last decades -- it's simply not an option at this time for them).

[300bps]

Sure. I work at an investment bank with hundreds of SQL Servers self-hosted myself. Your original comment I replied to said:

it looks like you want them to open their db up to the world?

What I was trying to say was that this is not the case. With Azure, it takes 10 seconds to open the firewall for a specific IP address. With a self-hosted firewall it probably takes longer but it's still not "opening their db to the world" as you stated. It's opening a hole in the firewall for a specific source IP address on a specific port with a specific destination IP address protected by a strong login and password. So, open for one person, closed to the rest of the world.

Your alternative is not to use the service.