Merge pull request #103036 from arv100kri/arv100kri/sql-mi

[Azure Search] Update SQL managed instance note

Author: PRMerger15

articles/search/search-howto-connecting-azure-sql-mi-to-azure-search-using-indexers.md

@@ -31,11 +31,14 @@ Check the Network Security Group has the correct **Inbound security rules** that
    ![NSG Inbound security rule](media/search-howto-connecting-azure-sql-mi-to-azure-search-using-indexers/nsg-rule.png "NSG Inbound security rule")
 
 > [!NOTE]
-> You can choose to be more restrictive in the inbound access to your managed SQL instance by replacing the current rule (`public_endpoint_inbound`) with 2 rules:
+> Indexers still require that SQL Managed Instance be configured with a public endpoint in order to read data.
+> However, you can choose to restrict the inbound access to that public endpoint by replacing the current rule (`public_endpoint_inbound`) with the following 2 rules:
 >
-> * Allowing inbound access from the `AzureCognitiveSearch` [service tag](https://docs.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) ("SOURCE" = `AzureCognitiveSearch`)
+> * Allowing inbound access from the `AzureCognitiveSearch` [service tag](https://docs.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) ("SOURCE" = `AzureCognitiveSearch`, "NAME" = `cognitive_search_inbound`)
 >
-> * Allowing inbound access from the IP address of the search service, which can be obtained by pinging its fully qualified domain name (eg., `<your-search-service-name>.search.windows.net`). ("SOURCE" = `IP address`)
+> * Allowing inbound access from the IP address of the search service, which can be obtained by pinging its fully qualified domain name (eg., `<your-search-service-name>.search.windows.net`). ("SOURCE" = `IP address`, "NAME" = `search_service_inbound`)
+>
+> For each of those 2 rules, set "PORT" = `3342`, "PROTOCOL" = `TCP`, "DESTINATION" = `Any`, "ACTION" = `Allow`
 
 ## Get public endpoint connection string
 Make sure you use the connection string for the **public endpoint** (port 3342, not port 1433).