---
cuppy_hub: azure
cuppy_path: reference/sql/managed-instance.md
cuppy_section: docs
cuppy_doc: TBTY-D743
cuppy_doc_uuid: e09308fe-b1e3-4730-987d-6320e66dc5a6
cuppy_permalink: https://cuppy.io/azure/d/TBTY-D743
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/azure/docs/reference/sql/managed-instance
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: d9b58f795db56f39e0fe660a184b04e7bc105a1537a1b28fec2cf064ac9234cb
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Azure SQL Managed Instance

Managed Instance is SQL Server as an instance (SQL Agent, cross-database queries, linked servers, CLR) **inside your VNet**. Choose it to lift SQL Server workloads that use instance-level features; for new apps, SQL Database (`reference/sql/connections-and-auth.md`) is simpler.

## The subnet

| Requirement | Detail |
|---|---|
| Dedicated | Only managed instances; not a gateway subnet |
| Delegation | `Microsoft.Sql/managedInstances` |
| NSG and route table | **Both must be associated.** The service adds and maintains its own rules and routes (service-aided configuration with a network intent policy); your entries can add on-premises routes or a 0.0.0.0/0 to a firewall |
| Size | At least 32 addresses (**/27**). Azure takes 5, each VM group 8, each General Purpose instance 2 and each Business Critical instance 5 (+2 zone-redundant), and **a scaling operation temporarily doubles an instance's addresses**. Multi-instance formula: `5 + (gp × 4) + (bc × 10) + (bc_zr × 2) + (vmg × 8)`, rounded up to a power of two |
| Growth | The range can't change while resources are in it: size for future instances and VM groups |

## Endpoints

| Endpoint | Name | Port | Connection type |
|---|---|---|---|
| **VNet-local** (default) | `<mi_name>.<dns_zone>.database.windows.net` | 1433 | Proxy or Redirect (the instance's setting) |
| **Public** (off unless enabled) | `<mi_name>.public.<dns_zone>.database.windows.net` | **3342** | Always Proxy |
| **Private endpoint** (from another VNet) | Same as VNet-local unless configured otherwise | 1433 | Always Proxy |

Always connect by name, and allow the ports to the **whole subnet range**: the instance's IP can change. Ask for an encrypted connection without trusting the server certificate blindly. Outbound connections from the instance (replication, linked servers to SQL Server) require TLS 1.2: older SQL Server partners need their TLS 1.2 updates.

## Entra logins and users

Managed Instance has **server-level Entra logins**, unlike SQL Database's contained users:

```sql
USE master;
CREATE LOGIN [app-orders-identity] FROM EXTERNAL PROVIDER;   -- managed identity, user or group
USE appdb;
CREATE USER [app-orders-identity] FROM LOGIN [app-orders-identity];   -- user name must equal the login name
ALTER ROLE db_datareader ADD MEMBER [app-orders-identity];
```

The instance's identity needs **Directory Readers** (or the equivalent Graph permissions) to resolve names. Entra-only authentication works as for SQL Database: `az sql mi ad-only-auth enable -g <rg> -n <mi>`; SQL Agent jobs work, but a group member can't own them, and transactional replication isn't supported with it on.

## Failover groups

Instance failover groups replicate **all** user databases to a secondary instance in another region; the listeners and failover policies behave as for SQL Database (`reference/sql/scale-and-continuity.md`). Logins live in `master` on each instance: create the same Entra logins on the secondary before you need it.

## Network symptoms

| Symptom | Cause → fix |
|---|---|
| Timeouts from a peered VNet or on-premises | NSG on the instance subnet doesn't allow 1433 (and 11000–11999 for Redirect) from the client range |
| Public endpoint unreachable | Public endpoint not enabled, or the NSG lacks an inbound **3342** rule |
| Deployment fails preparing the subnet | Subnet not delegated, not empty, missing NSG or route table, or too small |
| Logins fail with "principal not found" style errors | The instance identity can't read Entra (Directory Readers missing) |

The hub's reading: these rows turn the documented requirements into symptoms; Microsoft's pages don't give the exact messages.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->