AVD + NSG connecting to SQL Managed Instance

Question

We have an AVD environment and have an NSG attached to the subnet, all outgoing traffic has been blocked and we have set explicit outbound rules for things like HTTP\HTTPS, Entra Domain Services etc and this all works fine.

But we are having an issue allowing SQL traffic from AVD to connect to our SQL Managed Instance instance which is hosted within a seperate VNET.

We know the SQL Managed Instance works fine as we use it for other services fine.
Also SQL connects fine if we remove the NSG, so we know its the the rule that isnt quite right.

What should the destinantion service tag be set to for the SQL rule?
We have tried 'Sql' and 'Sql.UKSouth' but neither works.
The only rule that works is if we set the destinantion service tag to 'VirtualNetwork'.
Is it not possible to get a more accurate service tag to target the Managed Instance?