By default, Azure SQL Servers use SQL gateways to receive client connections. However, they implement a split logic depending on if the connection is internal (from inside Azure) or external.

For internal connections, they support a Redirect mode, where you log in and authenticate through the SQL gateway (your xxx.database.windows.net). Then, they instruct the SQL Client to connect again to a different worker server. For external connections, they use a mode called Proxy, where the entirety of the connection goes through the gateway you connected initially. Please see the SQL database connectivity docs for more info.

When a CloudGen Access Proxy is inside Azure, the SQL Gateway will try to use the redirect mode by default. This secondary connection is to a randomly allocated SQL worker server and, as such, is not caught by the CloudGen Access Proxy. In order to make this work with CloudGen Access, please switch the SQL Server to always use Proxy mode. After this change, all traffic will go through the same 1433 port on the same TCP connection instead of using the worker model.