Edit

Resolve private domain names in Azure SQL Managed Instance

  • Article

Applies to: Azure SQL Managed Instance

In this article, learn how Azure SQL Managed Instance resolves private domain names.

Overview

In certain situations, it's necessary for the SQL Server database engine to resolve domain names that don't exist in public DNS records. For example, the following scenarios are likely to involve private domain names:

Azure SQL Managed Instance is deployed in an Azure virtual network (VNet) and uses Azure-provided name resolution by default to resolve Internet addresses.

To change the default name resolution behavior and enable the resolution of private domain names, you can do one of the following:

Considerations

  • Be careful not to override or disable the resolution of domain names that Azure SQL Managed Instance uses internally. Always configure your custom DNS server so that it can resolve public domain names.
  • When you update the DNS servers for a virtual network, SQL Managed Instances in that network must also be notified of this change, as described in the Update SQL Managed Instances section in this article.
  • Always use a fully qualified domain name (FQDN) for the services that you want Azure SQL Managed Instance to resolve, such as your mail server or an on-premises SQL Server instance. Use FQDNs even if those services are within your private DNS zone. For example, use smtp.contoso.com. Creating a linked server or configuring replication that reference SQL Server VMs inside the same virtual network also requires a FQDN and a default DNS suffix; for example, SQLVM.internal.cloudapp.net.

Update SQL Managed Instances

If the DNS server setting is changed in a virtual network which already hosts SQL Managed Instances, then their virtual clusters need to synchronize with the changes in the DNS configuration. You can do so by using Azure PowerShell or the Azure CLI.

Note

Updating a single virtual cluster affects all SQL Managed Instances hosted in it.

Use Azure PowerShell to update the DNS server settings for an existing virtual cluster.

First, get the virtual network where the DNS settings have changed, and then use the Azure PowerShell command Invoke-AzResourceAction to synchronize DNS server configurations for all the virtual clusters in the subnet:

$ResourceGroup = 'enter resource group of virtual network'
$VirtualNetworkName = 'enter virtual network name'
$virtualNetwork = Get-AzVirtualNetwork -ResourceGroup $ResourceGroup -Name $VirtualNetworkName

Get-AzSqlVirtualCluster `
    | where SubnetId -match $virtualNetwork.Id `
    | select Id `
    | Invoke-AzResourceAction -Action updateManagedInstanceDnsServers -Force

Permissions

A user that is synchronizing DNS server configurations across a virtual network:

  • Should be a member of the Subscription Contributor role, or
  • Have a custom role with the Microsoft.Sql/virtualClusters/updateManagedInstanceDnsServers/action permission.

Next steps