Azure SQL Managed Instance

Managed Instance is SQL Server as an instance (SQL Agent, cross-database queries, linked servers, CLR) inside your VNet. Choose it to lift SQL Server workloads that use instance-level features; for new apps, SQL Database (reference/sql/connections-and-auth.md) is simpler.

The subnet

Requirement	Detail
Dedicated	Only managed instances; not a gateway subnet
Delegation	`Microsoft.Sql/managedInstances`
NSG and route table	Both must be associated. The service adds and maintains its own rules and routes (service-aided configuration with a network intent policy); your entries can add on-premises routes or a 0.0.0.0/0 to a firewall
Size	At least 32 addresses (/27). Azure takes 5, each VM group 8, each General Purpose instance 2 and each Business Critical instance 5 (+2 zone-redundant), and a scaling operation temporarily doubles an instance's addresses. Multi-instance formula: `5 + (gp × 4) + (bc × 10) + (bc_zr × 2) + (vmg × 8)`, rounded up to a power of two
Growth	The range can't change while resources are in it: size for future instances and VM groups

Endpoints

Endpoint	Name	Port	Connection type
VNet-local (default)	`<mi_name>.<dns_zone>.database.windows.net`	1433	Proxy or Redirect (the instance's setting)
Public (off unless enabled)	`<mi_name>.public.<dns_zone>.database.windows.net`	3342	Always Proxy
Private endpoint (from another VNet)	Same as VNet-local unless configured otherwise	1433	Always Proxy

Always connect by name, and allow the ports to the whole subnet range: the instance's IP can change. Ask for an encrypted connection without trusting the server certificate blindly. Outbound connections from the instance (replication, linked servers to SQL Server) require TLS 1.2: older SQL Server partners need their TLS 1.2 updates.

Entra logins and users

Managed Instance has server-level Entra logins, unlike SQL Database's contained users:

USE master;
CREATE LOGIN [app-orders-identity] FROM EXTERNAL PROVIDER;   -- managed identity, user or group
USE appdb;
CREATE USER [app-orders-identity] FROM LOGIN [app-orders-identity];   -- user name must equal the login name
ALTER ROLE db_datareader ADD MEMBER [app-orders-identity];

The instance's identity needs Directory Readers (or the equivalent Graph permissions) to resolve names. Entra-only authentication works as for SQL Database: az sql mi ad-only-auth enable -g <rg> -n <mi>; SQL Agent jobs work, but a group member can't own them, and transactional replication isn't supported with it on.

Failover groups

Instance failover groups replicate all user databases to a secondary instance in another region; the listeners and failover policies behave as for SQL Database (reference/sql/scale-and-continuity.md). Logins live in master on each instance: create the same Entra logins on the secondary before you need it.

Network symptoms

Symptom	Cause → fix
Timeouts from a peered VNet or on-premises	NSG on the instance subnet doesn't allow 1433 (and 11000–11999 for Redirect) from the client range
Public endpoint unreachable	Public endpoint not enabled, or the NSG lacks an inbound 3342 rule
Deployment fails preparing the subnet	Subnet not delegated, not empty, missing NSG or route table, or too small
Logins fail with "principal not found" style errors	The instance identity can't read Entra (Directory Readers missing)

The hub's reading: these rows turn the documented requirements into symptoms; Microsoft's pages don't give the exact messages.