Skip to content

Commit 270e6cd

Browse files
denreadenrea
authored
Merge pull request #296541 from WilliamDAssafMSFT/20250318-dedicated-sql-pool-connectivity
20250318 dedicated sql pool connectivity
2 parents 3cf9743 + c5d705d commit 270e6cd

File tree

2 files changed

+248
-38
lines changed

2 files changed

+248
-38
lines changed

‎articles/synapse-analytics/security/connectivity-settings.md

Lines changed: 212 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn to configure connectivity settings in Azure Synapse Analytics
44
author: danzhang-msft
55
ms.author: danzhang
66
ms.reviewer: wiassaf
7-
ms.date: 12/09/2024
7+
ms.date: 03/18/2025
88
ms.service: azure-synapse-analytics
99
ms.subservice: security
1010
ms.topic: conceptual
@@ -14,8 +14,17 @@ ms.topic: conceptual
1414

1515
This article explains connectivity settings in Azure Synapse Analytics and how to configure them where applicable.
1616

17+
For connection strings to Azure Synapse Analytics pools, see [Connect to Synapse SQL](../sql/connect-overview.md).
18+
19+
The capabilities and Azure portal appearance of configuring a dedicated SQL pool depend on whether it is in a logical SQL server or an Azure Synapse Analytics workspace.
20+
21+
### [Dedicated SQL pools in a workspace](#tab/workspace)
22+
1723
## Public network access
1824

25+
> [!NOTE]
26+
> These settings apply to dedicated SQL pools (formerly SQL DW) in an Azure Synapse analytics workspace. These instructions do not apply dedicated SQL pools (formerly SQL DW) associated with the logical SQL server.
27+
1928
You can use the public network access feature to allow incoming public network connectivity to your Azure Synapse workspace.
2029

2130
- When public network access is **disabled**, you can connect to your workspace only using [private endpoints](synapse-workspace-managed-private-endpoints.md).
@@ -53,9 +62,6 @@ Selecting the **Disable** option will not apply any firewall rules that you migh
5362
1. When disabled, the **Firewall rules** gray out to indicate that firewall rules are not in effect. Firewall rule configurations will be retained.
5463
1. Select **Save** to save the change. A notification will confirm that the network setting was successfully saved.
5564

56-
## Connection policy
57-
The connection policy for Synapse SQL in Azure Synapse Analytics is set to *Default*. You cannot change this in Azure Synapse Analytics. For more information, see [Connectivity architecture](/azure/azure-sql/database/connectivity-architecture#connection-policy).
58-
5965
## Minimal TLS version
6066

6167
The serverless SQL endpoint and development endpoint only accept TLS 1.2 and above.
@@ -69,7 +75,208 @@ Since December 2021, a minimum level of TLS 1.2 is required for workspace-manage
6975

7076
Azure policy to prevent modifications to the networking settings in Synapse Workspace is not currently available.
7177

78+
79+
### [Dedicated SQL pools in a logical SQL server](#tab/logical-sql-server)
80+
81+
## Networking and connectivity
82+
83+
You can change these settings in your [logical server](/azure/azure-sql/database/logical-servers). A logical SQL server can host both Azure SQL databases and standalone dedicated SQL pools not in an Azure Synapse Analytics workspace.
84+
85+
> [!IMPORTANT]
86+
> These settings apply to standalone dedicated SQL pools (formerly SQL DW) associated with the logical server, not in an Azure Synapse Analytics workspace. These instructions do not apply to dedicated SQL pools in an Azure Synapse analytics workspace.
87+
88+
### Change public network access
89+
90+
It's possible to change the public network access for your standalone dedicated SQL pool via the Azure portal, Azure PowerShell, and the Azure CLI.
91+
92+
> [!NOTE]
93+
> These settings take effect immediately after they're applied. Your customers might experience connection loss if they don't meet the requirements for each setting.
94+
95+
#### Configure public access in the Azure portal
96+
97+
To enable public network access for the logical server hosting your standalone dedicated SQL pool:
98+
99+
1. Go to the Azure portal, and go to the logical server in Azure.
100+
1. Under **Security**, select the **Networking** page.
101+
1. Choose the **Public access** tab, and then set the **Public network access** to **Select networks**.
102+
103+
From this page, you can add a virtual network rule, as well as configure firewall rules for your public endpoint.
104+
105+
Choose the **Private access** tab to configure a [private endpoint](/azure/azure-sql/database/private-endpoint-overview).
106+
107+
#### Configure public access in PowerShell
108+
109+
It's possible to change public network access by using Azure PowerShell.
110+
111+
> [!IMPORTANT]
112+
> The `Az` module replaces `AzureRM`. All future development is for the `Az.Sql` module. The following script requires the [Azure PowerShell module](/powershell/azure/install-az-ps).
113+
114+
The following PowerShell script shows how to `Get` and `Set` the **Public Network Access** property at the server level. Provide a strong password to replace `<strong password>` in the following PowerShell sample script.
115+
116+
```powershell
117+
# Get the Public Network Access property
118+
(Get-AzSqlServer -ServerName sql-server-name -ResourceGroupName sql-server-group).PublicNetworkAccess
119+
120+
# Update Public Network Access to Disabled
121+
$SecureString = ConvertTo-SecureString "<strong password>" -AsPlainText -Force
122+
123+
Set-AzSqlServer -ServerName sql-server-name -ResourceGroupName sql-server-group -SqlAdministratorPassword $SecureString -PublicNetworkAccess "Disabled"
124+
```
125+
126+
#### Configure public access in Azure CLI
127+
128+
It's possible to change the public network settings by using the [Azure CLI](/cli/azure/install-azure-cli).
129+
130+
The following CLI script shows how to change the **Public Network Access** setting in a Bash shell:
131+
132+
```azurecli-interactive
133+
134+
# Get current setting for Public Network Access
135+
az sql server show -n sql-server-name -g sql-server-group --query "publicNetworkAccess"
136+
137+
# Update setting for Public Network Access
138+
az sql server update -n sql-server-name -g sql-server-group --set publicNetworkAccess="Disabled"
139+
```
140+
141+
### Deny public network access
142+
143+
The default for the **Public network access** setting is **Disable**. Customers can choose to connect to a database by using either public endpoints (with IP-based server-level firewall rules or with virtual-network firewall rules), or [private endpoints](/azure/azure-sql/database/private-endpoint-overview) (by using Azure Private Link), as outlined in the [network access overview](/azure/azure-sql/database/network-access-controls-overview).
144+
145+
When **Public network access** is set to **Disable**, only connections from private endpoints are allowed. All connections from public endpoints will be denied with an error message similar to:
146+
147+
```output
148+
Error 47073
149+
An instance-specific error occurred while establishing a connection to SQL Server.
150+
The public network interface on this server is not accessible.
151+
To connect to this server, use the Private Endpoint from inside your virtual network.
152+
```
153+
154+
When **Public network access** is set to **Disable**, any attempts to add, remove, or edit any firewall rules will be denied with an error message similar to:
155+
156+
```output
157+
Error 42101
158+
Unable to create or modify firewall rules when public network interface for the server is disabled.
159+
To manage server or database level firewall rules, please enable the public network interface.
160+
```
161+
162+
Ensure that **Public network access** is set to **Selected networks** to be able to add, remove, or edit any firewall rules for Azure Synapse Analytics.
163+
164+
## Minimum TLS version
165+
166+
The minimum [Transport Layer Security (TLS)](https://support.microsoft.com/help/3135244/tls-1-2-support-for-microsoft-sql-server) version setting allows customers to choose which version of TLS is in use. It's possible to change the minimum TLS version by using the Azure portal, Azure PowerShell, and the Azure CLI.
167+
168+
After you test to confirm that your applications support it, we recommend setting the minimal TLS version to 1.3. This version includes fixes for vulnerabilities in previous versions and is the highest supported version of TLS for standalone dedicated SQL pools.
169+
170+
### Upcoming retirement changes
171+
172+
Azure has announced that support for older TLS versions (TLS 1.0, and 1.1) ends August 31, 2025. For more information, see [TLS 1.0 and 1.1 deprecation](https://azure.microsoft.com/updates/azure-support-tls-will-end-by-31-october-2024-2/).
173+
174+
Starting November 2024, you will no longer be able to set the minimal TLS version for Azure Synapse Analytics client connections below TLS 1.2.
175+
176+
### Configure minimum TLS version
177+
178+
You can configure the minimum TLS version for client connections by using the Azure portal, Azure PowerShell, or the Azure CLI.
179+
180+
> [!CAUTION]
181+
> - The default for the minimal TLS version is to allow all versions. After you enforce a version of TLS, it's not possible to revert to the default.
182+
> - Enforcing a minimum of TLS 1.3 might cause issues for connections from clients that don't support TLS 1.3 since not all [drivers](/sql/connect/driver-feature-matrix) and operating systems support TLS 1.3.
183+
184+
For customers with applications that rely on older versions of TLS, we recommend setting the minimal TLS version according to the requirements of your applications. If application requirements are unknown or workloads rely on older drivers that are no longer maintained, we recommend not setting any minimal TLS version.
185+
186+
For more information, see [TLS considerations for database connectivity](/azure/azure-sql/database/connect-query-content-reference-guide#tls-considerations-for-database-connectivity).
187+
188+
After you set the minimal TLS version, customers who are using a TLS version lower than the minimum TLS version of the server will fail to authenticate, with the following error:
189+
190+
```output
191+
Error 47072
192+
Login failed with invalid TLS version
193+
```
194+
195+
> [!NOTE]
196+
> The minimum TLS version is enforced at the application layer. Tools that attempt to determine TLS support at the protocol layer might return TLS versions in addition to the minimum required version when run directly against the endpoint.
197+
198+
#### Configure minimum TLS version in the Azure portal
199+
200+
1. Go to the Azure portal, and go to the logical server in Azure.
201+
1. Under **Security**, select the **Networking** page.
202+
1. Choose the **Connectivity** tab. Select the **Minimum TLS Version** desired for all databases associated with the server, and select **Save**.
203+
204+
#### Configure minimum TLS version in PowerShell
205+
206+
It's possible to change the minimum TLS version by using Azure PowerShell.
207+
208+
> [!IMPORTANT]
209+
> The `Az` module replaces `AzureRM`. All future development is for the `Az.Sql` module. The following script requires the [Azure PowerShell module](/powershell/azure/install-az-ps).
210+
211+
The following PowerShell script shows how to `Get` the **Minimal TLS Version** property at the logical server level:
212+
213+
```powershell
214+
$serverParams = @{
215+
ServerName = "sql-server-name"
216+
ResourceGroupName = "sql-server-group"
217+
}
218+
219+
(Get-AzSqlServer @serverParams).MinimalTlsVersion
220+
```
221+
222+
To `Set` the **Minimal TLS Version** property at the logical server level, substitute your Sql Administrator password for `<strong_password_here_password>`, and execute:
223+
224+
```powershell
225+
$serverParams = @{
226+
ServerName = "sql-server-name"
227+
ResourceGroupName = "sql-server-group"
228+
SqlAdministratorPassword = (ConvertTo-SecureString "<strong_password_here_password>" -AsPlainText -Force)
229+
MinimalTlsVersion = "1.2"
230+
}
231+
Set-AzSqlServer @serverParams
232+
```
233+
234+
#### Configure minimum TLS version in Azure CLI
235+
236+
It's possible to change the minimum TLS settings by using the Azure CLI.
237+
238+
> [!IMPORTANT]
239+
> All scripts in this section require the [Azure CLI](/cli/azure/install-azure-cli).
240+
241+
242+
The following CLI script shows how to change the **Minimal TLS Version** setting in a Bash shell:
243+
244+
```azurecli-interactive
245+
# Get current setting for Minimal TLS Version
246+
az sql server show -n sql-server-name -g sql-server-group --query "minimalTlsVersion"
247+
248+
# Update setting for Minimal TLS Version
249+
az sql server update -n sql-server-name -g sql-server-group --set minimalTlsVersion="1.2"
250+
```
251+
252+
## Identify client connections
253+
254+
You can use the Azure portal and SQL audit logs to identify clients that are connecting using TLS 1.0 and 1.0.
255+
256+
In the Azure portal, go to **Metrics** under **Monitoring** for your database resource, and then filter by *Successful connections*, and *TLS versions* = `1.0` and `1.1`:
257+
258+
You can also query [sys.fn_get_audit_file](/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql) directly within your database to view the `client_tls_version_name` in the audit file.
259+
260+
---
261+
262+
## Connection policy
263+
264+
The connection policy for Synapse SQL in Azure Synapse Analytics is set to **Default**. You cannot change the connection policy for dedicated SQL pools in Azure Synapse Analytics.
265+
266+
Logins for dedicated SQL pools in Azure Synapse Analytics can land on **any of the individual Gateway IP addresses or Gateway IP address subnets in a region**. For consistent connectivity, allow network traffic to and from **all the individual Gateway IP addresses and Gateway IP address subnets** in a region. Refer to the [Azure IP Ranges and Service Tags - Public Cloud](https://www.microsoft.com/download/details.aspx?id=56519) for a list of your region's IP addresses to allow.
267+
268+
- **Default:** This is the connection policy in effect on all servers after creation unless you explicitly alter the connection policy to either `Proxy` or `Redirect`. The default policy is:
269+
- `Redirect` for all client connections originating inside of Azure (for example, from an Azure Virtual Machine).
270+
- `Proxy` for all client connections originating outside (for example, connections from your local workstation).
271+
- **Redirect:** Clients establish connections directly to the node hosting the database, leading to reduced latency and improved throughput. For connections to use this mode, clients need to:
272+
- Allow outbound communication from the client to all Azure SQL IP addresses in the region on ports in the range of 11000 to 11999. Use the Service Tags for SQL to make this easier to manage. If you are using Private Link, see [Use Redirect connection policy with private endpoints](/azure/azure-sql/database/private-endpoint-overview#use-redirect-connection-policy-with-private-endpoints) for the port ranges to allow.
273+
- Allow outbound communication from the client to Azure SQL Database gateway IP addresses on port 1433.
274+
- When using the Redirect connection policy, refer to the [Azure IP Ranges and Service Tags – Public Cloud](https://www.microsoft.com/download/details.aspx?id=56519) for a list of your region's IP addresses to allow.
275+
- **Proxy:** In this mode, all connections are proxied via the Azure SQL Database gateways, leading to increased latency and reduced throughput. For connections to use this mode, clients need to allow outbound communication from the client to Azure SQL Database gateway IP addresses on port 1433.
276+
- When using the Proxy connection policy, allow your region's IP addresses from the list of [Gateway IP addresses](gateway-ip-addresses.md).
277+
72278
## Related content
73279

74280
- [Azure Synapse Analytics IP firewall rules](synapse-workspace-ip-firewall.md)
75-
281+
- [What's the difference between Azure Synapse (formerly SQL DW) and Azure Synapse Analytics Workspace](https://aka.ms/dedicatedSQLpooldiff)
282+
- [What is a logical SQL server in Azure SQL Database and Azure Synapse?](/azure/azure-sql/database/logical-servers)

0 commit comments

Comments
 (0)