Hi sreedxc - using runbook means that you are using automation infrastructure, therefore it needs to be allowed by Azure SQL DB firewall. as this is a service you do not have a specific outgoing IP so you can whitelist it.
some options you may consider:
* Use hybrid worker, in such case your own machine will execute the maintenance and it use its own IP address - the complexity here is that you need to maintain your own worker.
* Configure Azure SQL DB firewall to allow Azure automation IP range (not so realistic, as it has many ranges, and you are limited by 128 rules for SQLDB firewall, as well as this needs maintenance and update manually)
* Allow Azure Services to access the database (this means that every Azure resource can communicate with your database)
if the above is not suitable for you, you may review your existing automation \ jobs tools to run the maintenance.
HTH,
Yochanan