How is SQL Server host identity ensured?
I'm not familiar with Azure but I can speak to SQL Server in general. SQL has a property called Force Encryption (which is set through SQL's Configuration Manager), which as it sounds will force clients to connect over encrypted sessions. This is done with certificates just like SSL. This guarantees the authenticity of the server as well as providing for encrypted communications. 

It's a bit nuanced - you can use a certificate issued by a CA that the clients trust or SQL can use a self signed certificate (less secure). There's also client side settings you can set in the connection string that will influence the connection - depending on ODBC or OLEDB the pertinent properties are something like "Encrypt" and "TrustServerCertificate".