Application Security Group

We can associate a VM/NIC with an application security group (ASG) easily either through GUI or Powershell.

If I have a SQL Server (PaaS) which is not a VM, how do I associate the SQL Server to application security group? There doesn't seem to be a GUI interface where I can associate it. I do see from Powershell command that the private endpoint or private NIC used on the SQL server has a property for application security group, but the normal set-aznetworkinterface doesn't work on private endpoint. Anyone knows a way to somehow associate it with a application security group? Thanks.