Forum Discussion

PhilFancyAndMe's avatar
PhilFancyAndMe
Iron Contributor
Aug 28, 2024

Azure Web App - Connect to Azure Managed Instance SQL DB

Hi there,

need ideas how to let a Azure Web App connect to a Azure SQL DB (managed by Azure Managed Instance). 

 

Web App has public network access but no private endpoint:

 

SQL Managed Instance is added to Azure virtual network/subnet.

 

So, Web App is facing to the internet only. SQL Server is connected to the internal network only. 

Web App cannot connect to sql instance. 

 

I tried to create a private endpoint on the managed instance to get it work. But without success.

 

As I am not too deep into the networking part of Azure I hoped to get help how to approach this. I need to be able to connect the web app to the managed instance. Just creating a private endpoint on the Web App ressource shows a warning that this undermines security. So I am looking for a secure way how to achieve connection from Web App to SQL instance/database.

 

Thanks in advance.

Additional information:
The sql instance and databases are reachable from in Azure running virtual machines that have network adapters in the virtual network where the sql server is running. It's only the web app that is not able to connect (most likely because of missing internal network connection). 

 

Microsoft.Data.SqlClient.SqlException (0x80131904): A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - An attempt was made to access a socket in a way forbidden by its access permissions.)

       ---> System.ComponentModel.Win32Exception (10013): An attempt was made to access a socket in a way forbidden by its access permissions.

 

 

virtual network

2 Replies

Sort By
  • Surendra_Aderu's avatar
    Surendra_Aderu
    Copper Contributor
    Aug 11, 2025

    At the web app use the VNET integration, typically you need vnet/subnet to configure and manage the outbound traffic. SQL managed instance is already deployed under VNET. enable the peering if it's two different VNETs, if its' same VNET (SQL MI subnet and web app integrated subnet) no need of peering. 

    let me know if any issues.

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Oct 02, 2024

    PhilFancyAndMe 

     

    Refer on below on some recommdanations:

     

    1. Use Virtual Network Integration:

      • Integrate your Web App with a Virtual Network: This allows your Web App to access resources in the virtual network where your SQL Managed Instance is located.
      • Follow the steps in this tutorial to set up VNet integration for your Web App.

    2. Private Endpoint for SQL Managed Instance:

      • Ensure that you have correctly set up a private endpoint for your SQL Managed Instance. This allows your Web App to securely connect to the SQL Managed Instance over a private IP address.
      • You can follow this guide to set up and configure private endpoints.

    3. Managed Identity:

      • Use a managed identity for your Web App to securely connect to the SQL Managed Instance without storing credentials in your code.
      • Assign a system-assigned or user-assigned managed identity to your Web App and grant it access to the SQL Managed Instance.
      • To configure managed identity for your Web App and grant it access to the SQL Managed Instance.

    4. Network Security Groups (NSGs):

      • Ensure that the Network Security Groups (NSGs) associated with your virtual network and subnets allow traffic between your Web App and the SQL Managed Instance.
      • You might need to create inbound and outbound rules to permit traffic on the necessary ports (e.g., port 1433 for SQL Server).

    5. DNS Configuration:

      • Ensure that your Web App can resolve the private endpoint DNS name of your SQL Managed Instance. You might need to configure custom DNS settings or use Azure DNS.

    6. Connection Strings:

      • Update your Web App’s connection strings to use the private endpoint’s IP address or DNS name.
      • Ensure that the connection string includes the necessary parameters for secure connections, such as Encrypt=True and TrustServerCertificate=False.

Resources