Merge pull request #34738 from VanMSFT/20250717_fixTLS

Update TLS minimum version

Author: JamesJBarnett

azure-sql/managed-instance/minimal-tls-version-configure.md

@@ -1,40 +1,40 @@
 ---
-title: Configure minimal TLS version - managed instance
-description: "Learn how to configure minimal TLS version for managed instance"
+title: Configure Minimal TLS Version - SQL Managed Instance
+description: "Learn how to configure minimal TLS version for a managed instance"
 author: zoran-rilak-msft
 ms.author: zoranrilak
-ms.reviewer: mathoma
-ms.date: 10/21/2022
+ms.reviewer: mathoma, vanto
+ms.date: 07/17/2025
 ms.service: azure-sql-managed-instance
 ms.subservice: security
 ms.topic: how-to
-ms.custom: devx-track-azurecli
+ms.custom:
+  - devx-track-azurecli
 ms.devlang: azurecli
 ---
 # Configure minimal TLS version in Azure SQL Managed Instance
-> [!IMPORTANT]
-> **Upcoming retirement changes**
-> 
-> Azure has announced that support for older TLS versions (TLS 1.0, and 1.1) ends August 31, 2025. For more information, see [TLS 1.0 and 1.1 deprecation](https://azure.microsoft.com/updates/azure-support-tls-will-end-by-31-october-2024-2/).
-> Starting November 2024, you will no longer be able to set the minimal TLS version for Azure SQL Managed Instance client connections below TLS 1.2. 
 
-The Minimal [Transport Layer Security (TLS)](/troubleshoot/sql/database-engine/connect/tls-1-2-support-microsoft-sql-server) Version setting allows customers to control the version of TLS used by their Azure SQL Managed Instance.
+> [!IMPORTANT]  
+> **Retirement changes**
+>
+> Azure has announced that support for older TLS versions (TLS 1.0, and 1.1) ends August 31, 2025. For more information, see [TLS 1.0 and 1.1 deprecation](https://azure.microsoft.com/updates/azure-support-tls-will-end-by-31-october-2024-2/).
+> Starting November 2024, you'll no longer be able to set the minimal TLS version for Azure SQL Managed Instance client connections below TLS 1.2.
 
-At present we support TLS 1.0, 1.1 and 1.2. Setting a Minimal TLS Version ensures that subsequent, newer TLS versions are supported. For example,  e.g.,  choosing  a TLS version greater than 1.1. means only connections with TLS 1.1 and 1.2 are accepted and TLS 1.0 is rejected. After testing to confirm your applications supports it, we recommend setting minimal TLS version to 1.2 since it includes fixes for vulnerabilities found in previous versions and is the highest version of TLS supported in Azure SQL Managed Instance.
+The Minimal [Transport Layer Security (TLS)](/troubleshoot/sql/database-engine/connect/tls-1-2-support-microsoft-sql-server) version setting allows customers to control the version of TLS used by their Azure SQL Managed Instance.
 
-For customers with applications that rely on older versions of TLS, we recommend setting the Minimal TLS Version per the requirements of your applications. For customers that rely on applications to connect using an unencrypted connection, we recommend not setting any Minimal TLS Version. 
+Setting **Minimum TLS version** to 1.2 is currently enforced for SQL Managed Instance. Setting a Minimal TLS version ensures that subsequent, newer TLS versions are supported. Only connections using TLS 1.2 or above are accepted.
 
 For more information, see [TLS considerations for SQL Database connectivity](../database/connect-query-content-reference-guide.md#tls-considerations-for-database-connectivity).
 
-After setting the Minimal TLS Version, login attempts from clients that are using a TLS version lower than the Minimal TLS Version of the server will fail with following error:
+After setting the Minimal TLS version, login attempts from clients that are using a TLS version lower than the Minimal TLS version of the server will fail with following error:
 
 ```output
 Error 47072
 Login failed with invalid TLS version
 ```
 
 > [!NOTE]
-> When you configure a minimum TLS version, that minimum version is enforced at the application layer. Tools that attempt to determine TLS support at the protocol layer may return TLS versions in addition to the minimum required version when run directly against the managed instance endpoint.
+> When you configure a minimum TLS version, that minimum version is enforced at the application layer. Tools that attempt to determine TLS support at the protocol layer might return TLS versions in addition to the minimum required version when run directly against the managed instance endpoint.
 
 ## Set minimal TLS version via PowerShell
 
@@ -71,3 +71,7 @@ az sql mi show -n sql-instance-name -g resource-group --query "minimalTlsVersion
 # Update setting for Minimal TLS Version
 az sql mi update -n sql-instance-name -g resource-group --set minimalTlsVersion="1.2"
 ```
+
+## Related content
+
+- [Connectivity architecture for Azure SQL Managed Instance](connectivity-architecture-overview.md)