added note about nsg tag

https://teams.microsoft.com/l/message/19:[email protected]/1584033599552?tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47&groupId=dba442ce-3c98-4a6f-bec7-8bb2ec845ec9&parentMessageId=1584033599552&teamName=SQL%20Azure%20Chat&channelName=Managed%20Instance&createdTime=1584033599552

Author: MashaMSFT

articles/sql-database/sql-database-managed-instance-transactional-replication.md

@@ -90,6 +90,7 @@ There are different [types of replication](https://docs.microsoft.com/sql/relati
 - An Azure Storage Account share for the working directory used by replication. 
 - Port 445 (TCP outbound) needs to be open in the security rules of the managed instance subnet to access the Azure file share. 
 - Port 1433 (TCP outbound) needs to be opened if the Publisher/Distributor are on a managed instance and the subscriber is on-premises.
+- If the subscriber is an Azure SQL Database, it may be necessary to change the managed instance NSG outbound security rule for `allow_linkedserver_outbound` for the port 1433 `Destination Service tag` from `virtualnetwork` to `internet`. 
 - All types of replication participants (Publisher, Distributor, Pull Subscriber, and Push Subscriber) can be placed on managed instances, but the publisher and the distributor must be either both in the cloud or both on-premises.
 - If either the publisher, distributor, and/or the subscriber exist in different virtual networks, then VPN peering must be established between each entity, such that there is VPN peering between the publisher and distributor, and/or there is VPN peering between the distributor and subscriber.