Public endpoint for SQL Database Managed Instance is available as of today

Public endpoint for Azure Managed Instance provides the ability to connect to Azure Managed Instance from the Internet without using a and is for data communication only. Public endpoint for data can simultaneously coexist with the private endpoint. With global availability as of today, this feature will help support many new integration scenarios. For security reasons, the implementation allows for Separation of Duties (SoD) between a database administrator and a administrator when enabling the public endpoint.
The public endpoint for managed instance can today be enabled/disabled via PowerShell script. The support for Azure portal will be coming within the next two weeks or so, as soon as all updates are rolled out.
Security requirements and separation of duties
To enable public endpoint for managed instance, two steps are required, and for separation of duties two separate roles with the following database and permissions need to perform these steps:
  • Database administrator who has RBAC permissions in scope Microsoft.Sql/managedInstances/* needs to run a PowerShell script to enable public endpoint for managed instance. However, the public endpoint will not be accessible from the Internet until the second step by  administrator is performed.
  • Network administrator who has RBAC permissions in scope Microsoft.Network/ * needs to open the port 3342 used by the public endpoint on NSG and provide UDR route to avoid asymmetric routing.
Enable public endpoint for data

To enable public endpoint for data, please follow these steps:

1. Database administrator with appropriate permissions needs to execute the below provided Power Shell script. Please replace {subscription-id} with your subscription, replace {rg-name} with the resource group to which managed instance was deployed, and replace {mi-name} with the name of your managed instance.

Install-Module -Name Az
Import-Module Az.Accounts
Import-Module Az.Sql 
Select-AzSubscription -SubscriptionId {subscription-id}
$mi = Get-AzSqlInstance -ResourceGroupName {rg-name} -Name {mi-name} 
$mi = $mi | Set-AzSqlInstance -PublicDataEndpointEnabled $true -force

2. Network administrator with appropriate permissions needs to setup an NSG to open the port 3342 for the inbound traffic. You can follow this guide.

Please note the port 3342 is used for public endpoint TDS connections to managed instance. This port cannot be customized. 

The above steps complete the process of enabling public endpoint for managed instance.

Use public endpoint from clients

To access managed instance from clients through the Internet, your application(s) need to use the hostname of the following format (the “.public” is added after the managed instance name, including the port):


See the example of connecting with SSMS through the public endpoint to managed instance in the image below.


Disable public endpoint

In case you need to disable the public endpoint, database administrator needs to execute the following Power Shell command:

Set-AzSqlInstance -PublicDataEndpointEnabled $false -force

In addition, network administrator needs to remove the NSG rule for the inbound port 3342.

Product road map

Within the next period as soon as all updates are rolled out, it will also be possible to enable/disable public endpoint from the Azure portal (within Managed Instance resource, Virtual network). In addition, the option to enable/disable public endpoint will also show at the time of creating a new Managed Instance.

Public endpoint feature for managed instance is now a production ready service. Documentation and further announcements will follow.
Azure Managed Instance Product Group


This article was originally published by Microsoft's Azure Blog. You can find the original article here.