Entra-secured Azure Web Service with an Sql Database

I need a small, working proof-of-concept that shows how to secure an Azure Web App with Microsoft Entra ID for a single tenant, then let that app read from and write to an Azure SQL database that stores a simple Customers table.

Here is what I’m after:

• Authentication: Single Sign-On through Entra ID. Only accounts in my organization should be able to log in.
• Sample application: C# / .NET (latest LTS). A minimal Razor Pages site is fine; I mainly want the plumbing done correctly.
• Data layer: Use Entity Framework Core or plain ADO.NET—your call—to perform full read/write operations against the Azure SQL back-end.
• Security best practice: connect with a managed identity (no connection strings full of secrets).
• Deployment: The entire flow should be reproducible from scratch. I need the ARM/Bicep or Terraform scripts—or Azure CLI commands—plus a step-by-step README that walks through:
– creating the Entra app registration
– granting DB permissions
– deploying the web service
– seeding / testing data access

Acceptance criteria
1. I can clone the repo, follow your guide, and within one subscription see the site authenticate me via SSO and display a customer list pulled from Azure SQL.
2. I can add a customer through the UI and immediately retrieve it.
3. Only users in my tenant can reach the protected pages; unauthenticated users are redirected to Entra sign-in.

Please include concise inline comments in the code so I can extend it later. Feel free to ask clarifying questions before you start.