You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: azure-sql/database/connectivity-settings.md
+26-23Lines changed: 26 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,40 +1,40 @@
1
1
---
2
-
title: Connectivity settings for Azure SQL Database and Azure Synapse Analytics
3
-
titleSuffix: Azure SQL Database and Azure Synapse Analytics
4
-
description: This article explains the Transport Layer Security (TLS) version choice and the Proxy versus Redirect settings for Azure SQL Database and Azure Synapse Analytics.
2
+
title: Connectivity settings
3
+
titleSuffix: Azure SQL Database and SQL database in Fabric
4
+
description: This article explains the Transport Layer Security (TLS) version choice and the Proxy versus Redirect settings for Azure SQL Database and SQL database in Microsoft Fabric.
This article introduces settings that control connectivity to the server for Azure SQL Database and [dedicated SQL pool (formerly SQL DW)](/azure/synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is) in Azure Synapse Analytics.
This article introduces settings that control connectivity to the server for Azure SQL Database and SQL database in Microsoft Fabric.
21
23
22
24
- For more information on various components that direct network traffic and connection policies, see [connectivity architecture](connectivity-architecture.md).
23
25
- This article does not apply to Azure SQL Managed Instance, instead see [Connect your application to Azure SQL Managed Instance](../managed-instance/connect-application-instance.md).
24
-
- This article does not apply to dedicated SQL pools in Azure Synapse Analytics workspaces. See [Azure Synapse Analytics IP firewall rules](/azure/synapse-analytics/security/synapse-workspace-ip-firewall) for guidance on how to configure IP firewall rules for Azure Synapse Analytics with workspaces.
26
+
- This article does *not* apply to Azure Synapse Analytics.
27
+
- For settings that control connectivity to dedicated SQL pools in Azure Synapse Analytics, see [Azure Synapse Analytics connectivity settings](/azure/synapse-analytics/security/connectivity-settings).
28
+
- For connection strings to Azure Synapse Analytics pools, see [Connect to Synapse SQL](/azure/synapse-analytics/sql/connect-overview).
29
+
- See [Azure Synapse Analytics IP firewall rules](/azure/synapse-analytics/security/synapse-workspace-ip-firewall) for guidance on how to configure IP firewall rules for Azure Synapse Analytics with workspaces.
25
30
26
31
## Networking and connectivity
27
32
28
-
You can change these settings in your [logical server](logical-servers.md). A logical SQL server can host both Azure SQL databases and standalone dedicated SQL pools not in an Azure Synapse Analytics workspace.
29
-
30
-
> [!NOTE]
31
-
> These settings apply to Azure SQL databases and dedicated SQL pools (formerly SQL DW) associated with the logical server. These instructions do not apply to dedicated SQL pools in an Azure Synapse analytics workspace.
32
-
33
-
:::image type="content" source="media/connectivity-settings/manage-connectivity-settings.png" alt-text="Screenshot of the Firewalls and virtual networks settings in Azure portal for SQL server.":::
33
+
You can change these settings in your [logical server](logical-servers.md).
34
34
35
35
## Change public network access
36
36
37
-
It's possible to change the public network access for your Azure SQL Database or standalone dedicated SQL pool via the Azure portal, Azure PowerShell, and the Azure CLI.
37
+
It's possible to change the public network access for your Azure SQL Database via the Azure portal, Azure PowerShell, and the Azure CLI.
38
38
39
39
> [!NOTE]
40
40
> These settings take effect immediately after they're applied. Your customers might experience connection loss if they don't meet the requirements for each setting.
@@ -43,6 +43,8 @@ It's possible to change the public network access for your Azure SQL Database or
43
43
44
44
To enable public network access for the logical server hosting your databases:
45
45
46
+
:::image type="content" source="media/connectivity-settings/manage-connectivity-settings.png" alt-text="Screenshot of the Firewalls and virtual networks settings in Azure portal for a logical SQL server.":::
47
+
46
48
1. Go to the Azure portal, and go to the [logical server in Azure](logical-servers.md).
47
49
1. Under **Security**, select the **Networking** page.
48
50
1. Choose the **Public access** tab, and then set the **Public network access** to **Select networks**.
@@ -109,7 +111,7 @@ Unable to create or modify firewall rules when public network interface for the
109
111
To manage server or database level firewall rules, please enable the public network interface.
110
112
```
111
113
112
-
Ensure that **Public network access** is set to **Selected networks** to be able to add, remove, or edit any firewall rules for Azure SQL Database and Azure Synapse Analytics.
114
+
Ensure that **Public network access** is set to **Selected networks** to be able to add, remove, or edit any firewall rules for Azure SQL Database.
113
115
114
116
## Minimum TLS version
115
117
@@ -121,7 +123,7 @@ Currently, Azure SQL Database supports TLS 1.0, 1.1, 1.2, and 1.3. Setting a min
121
123
122
124
Azure has announced that support for older TLS versions (TLS 1.0, and 1.1) ends August 31, 2025. For more information, see [TLS 1.0 and 1.1 deprecation](https://azure.microsoft.com/updates/azure-support-tls-will-end-by-31-october-2024-2/).
123
125
124
-
Starting November 2024, you will no longer be able to set the minimal TLS version for Azure SQL Database and Azure Synapse Analytics client connections below TLS 1.2.
126
+
Starting November 2024, you will no longer be able to set the minimal TLS version for Azure SQL Database client connections below TLS 1.2.
125
127
126
128
### Configure minimum TLS version
127
129
@@ -209,11 +211,11 @@ You can use the Azure portal and SQL audit logs to identify clients that are con
209
211
210
212
In the Azure portal, go to **Metrics** under **Monitoring** for your database resource, and then filter by *Successful connections*, and *TLS versions* = `1.0` and `1.1`:
211
213
212
-
:::image type="content" source="media/connectivity-settings/connections-in-portal.png" alt-text="Screenshot of the monitoring page for the database resource in the Azure portal with successful tls 1.0 and 1.1 connections filtered. ":::
214
+
:::image type="content" source="media/connectivity-settings/connections-in-portal.png" alt-text="Screenshot of the monitoring page for the database resource in the Azure portal with successful T L S 1.0 and 1.1 connections filtered. ":::
213
215
214
-
You can also query [sys.fn_get_audit_file](/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql) directly within your database to view the `client_tls_version_name` in the audit file:
216
+
You can also query [sys.fn_get_audit_file](/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql) directly within your database to view the `client_tls_version_name` in the audit file, looking for events named `audit_event`.
215
217
216
-
:::image type="content" source="media/connectivity-settings/tls-entries-in-audit-file.png" alt-text="Screenshot of a query result of the audit file showing tls version connections. ":::
218
+
:::image type="content" source="media/connectivity-settings/tls-entries-in-audit-file.png" alt-text="Screenshot of a query result of the audit file showing T L S version connections. ":::
217
219
218
220
219
221
## Change the connection policy
@@ -276,6 +278,8 @@ It's possible to change the connection policy for your logical server by using t
276
278
277
279
### Azure CLI in a Bash shell
278
280
281
+
For information on how to change the Azure SQL Database connection policy for a server, see [conn-policy](/cli/azure/sql/server/conn-policy)
282
+
279
283
The following CLI script shows how to change the connection policy in a Bash shell:
This article walks through the basic considerations that a developer should be aware of when writing code to connect to your database in Azure. This article applies to Azure SQL Database, and Azure SQL Managed Instance.
@@ -23,23 +24,22 @@ This article walks through the basic considerations that a developer should be a
23
24
24
25
You can use various [programming languages and platforms](connect-query-content-reference-guide.md) to connect and query Azure SQL Database. You can find [sample applications](https://azure.microsoft.com/resources/samples/?service=sql-database&sort=0) that you can use to connect to the database.
25
26
26
-
You can leverage open-source tools like [cheetah](https://github.com/wunderlist/cheetah), [sql-cli](https://www.npmjs.com/package/sql-cli), [VS Code](https://code.visualstudio.com/). Additionally, Azure SQL Database works with Microsoft tools like [Visual Studio](https://www.visualstudio.com/downloads/) and [SQL Server Management Studio](/sql/ssms/sql-server-management-studio-ssms). You can also use the Azure portal, PowerShell, and REST APIs to help you gain additional productivity.
27
+
You can use open-source tools like [cheetah](https://github.com/wunderlist/cheetah), [sql-cli](https://www.npmjs.com/package/sql-cli), [VS Code](https://code.visualstudio.com/). Additionally, Azure SQL Database works with Microsoft tools like [Visual Studio](https://visualstudio.microsoft.com/downloads) and [SQL Server Management Studio](/sql/ssms/sql-server-management-studio-ssms). You can also use the Azure portal, PowerShell, and REST APIs to help you gain more productivity.
27
28
28
29
## Authentication
29
30
30
31
Access to Azure SQL Database is protected with logins and firewalls. Azure SQL Database and SQL Managed Instance support users and logins for both SQL authentication and [authentication](authentication-aad-overview.md) with Microsoft Entra ID ([formerly Azure Active Directory](/entra/fundamentals/new-name)). Microsoft Entra logins are generally available in SQL Managed Instance and are in Public Preview for Azure SQL Database.
31
32
32
-
Learn more about [managing database access and login](logins-create-manage.md).
33
+
Learn more about [managing database access and logins](logins-create-manage.md).
33
34
34
35
## Client connections
35
36
36
37
In your client connection logic, override the default timeout to be 30 seconds. The default of 15 seconds is too short for connections that depend on the internet.
37
38
38
-
If you are using a [connection pool](/dotnet/framework/data/adonet/sql-server-connection-pooling), be sure to close the connection the instant your program is not actively using it, and is not preparing to reuse it.
39
+
If you're using a [connection pool](/dotnet/framework/data/adonet/sql-server-connection-pooling), be sure to close the connection the instant your program isn't actively using it, and isn't preparing to reuse it.
39
40
40
41
Avoid long-running transactions because any infrastructure or connection failure might roll back the transaction. If possible, split the transaction in the multiple smaller transactions and use [batching to improve performance](../performance-improve-use-batching.md).
41
42
42
-
43
43
It's possible to connect your application to your Azure SQL resource by using the following languages:
44
44
45
45
-[.NET with Visual Studio](connect-query-dotnet-visual-studio.md)
@@ -53,24 +53,23 @@ It's possible to connect your application to your Azure SQL resource by using th
53
53
It's possible to configure Microsoft Entra authentication to your Azure SQL resource. Review the following articles for more information:
54
54
55
55
-[Connect to Azure SQL with Microsoft Entra authentication and SqlClient](/sql/connect/ado-net/sql/azure-active-directory-authentication)
56
-
-[Use Managed Identities in Microsoft Entra ID for Azure SQL](authentication-azure-ad-user-assigned-managed-identity.md)
56
+
-[Managed identities in Microsoft Entra for Azure SQL](authentication-azure-ad-user-assigned-managed-identity.md)
57
57
-[Connect to SQL Database from .NET App Service without secrets using a managed identity](/azure/app-service/tutorial-connect-msi-sql-database)
58
58
59
-
60
59
## Resiliency
61
60
62
-
Azure SQL Database is a cloud service where you might expect transient errors that happen in the underlying infrastructure or in the communication between cloud entities. Although Azure SQL Database is resilient on the transitive infrastructure failures, these failures might affect your connectivity. When a transient error occurs while connecting to SQL Database, your code should [retry the call](troubleshoot-common-connectivity-issues.md). We recommend that retry logic use backoff logic, so that it does not overwhelm the service with multiple clients retrying simultaneously. Retry logic depends on the [error messages for SQL Database client programs](troubleshoot-common-errors-issues.md).
61
+
Azure SQL Database is a cloud service where you might expect transient errors that happen in the underlying infrastructure or in the communication between cloud entities. Although Azure SQL Database is resilient on the transitive infrastructure failures, these failures might affect your connectivity. When a transient error occurs while connecting to SQL Database, your code should [retry the call](troubleshoot-common-connectivity-issues.md). We recommend that retry logic use backoff logic, so that it doesn't overwhelm the service with multiple clients retrying simultaneously. Retry logic depends on the [error messages for SQL Database client programs](troubleshoot-common-errors-issues.md).
63
62
64
63
For more information about how to prepare for planned maintenance events on your Azure SQL Database, see [planning for Azure maintenance events in Azure SQL Database](planned-maintenance.md).
65
64
66
65
## Network considerations
67
66
68
-
- On the computer that hosts your client program, ensure the firewall allows outgoing TCP communication on port 1433. More information: [Configure an Azure SQL Database firewall](firewall-configure.md).
69
-
- If your client program connects to SQL Database while your client runs on an Azure virtual machine (VM), you must open certain port ranges on the VM. More information: [Ports beyond 1433 for ADO.NET 4.5 and SQL Database](adonet-v12-develop-direct-route-ports.md).
70
-
- Client connections to Azure SQL Database sometimes bypass the proxy and interact directly with the database. Ports other than 1433 become important. For more information, [Azure SQL Database connectivity architecture](connectivity-architecture.md) and [Ports beyond 1433 for ADO.NET 4.5 and SQL Database](adonet-v12-develop-direct-route-ports.md).
67
+
- On the computer that hosts your client program, ensure the firewall allows outgoing TCP communication on port 1433. More information: [Azure SQL Database IP firewall rules](firewall-configure.md).
68
+
- If your client program connects to SQL Database while your client runs on an Azure virtual machine (VM), you must open certain port ranges on the VM. More information: [Ports beyond 1433 for ADO.NET 4.5](adonet-v12-develop-direct-route-ports.md).
69
+
- Client connections to Azure SQL Database sometimes bypass the proxy and interact directly with the database. Ports other than 1433 become important. For more information, [Connectivity architecture](connectivity-architecture.md) and [Ports beyond 1433 for ADO.NET 4.5](adonet-v12-develop-direct-route-ports.md).
71
70
- For networking configuration for an instance of SQL Managed Instance, see [network configuration for SQL Managed Instance](../managed-instance/how-to-content-reference-guide.md#network-configuration).
72
71
73
-
## Next steps
72
+
## Related content
74
73
75
74
Explore all the capabilities of [SQL Database](sql-database-paas-overview.md) and [SQL Managed Instance](../managed-instance/sql-managed-instance-paas-overview.md).
0 commit comments