Forum Discussion

fabricpribeiro's avatar
fabricpribeiro
Icon for Post Patron rankPost Patron
5 months ago
Solved

Fabric - Mirroring SQLServer MI - Gateway

Dears,   While studying the requirements of how to configure Fabric mirroring to SQLMI, I found the below statement:   Networking requirements: If your Azure SQL Managed Instance is not publicl...
  • arabalca's avatar
    5 months ago

    Hi fabricpribeiro  , 

     

    P1. It depends on the level of security you want to apply to data movement. The main difference, and the reason it is typically used, is related to network security. It also provides additional control over data movement security, auditing, and connectivity isolation.

    More: https://learn.microsoft.com/en-us/data-integration/vnet/overview

     

    P2. I have reviewed the documentation, and the first part of the paragraph is missing in this section:

     

    "If your Azure SQL Managed Instance is not publicly accessible, create a virtual network data gateway or on-premises data gateway to mirror the data. Make sure the Azure Virtual Network or gateway server's network can connect to the Azure SQL Managed Instance via a private endpoint."

     

    More: https://learn.microsoft.com/en-us/fabric/mirroring/azure-sql-managed-instance#mirroring-azure-sql-managed-instance-behind-firewall

     

    The documentation states that if the Azure SQL Managed Instance is not publicly accessible, you must create either a Virtual Network data gateway or an on-premises data gateway to replicate the data. Additionally, the gateway network must be able to connect to the SQL Managed Instance through a Private Endpoint.

     

    Therefore, the Private Endpoint mentioned in the requirement refers to the Azure SQL Managed Instance Private Endpoint (source side), not the Fabric SQL Analytics Endpoint.

     

    If my comment helped solve your question, it would be great if you could like the comment and mark it as the accepted solution. It helps others with the same issue and also motivates me to keep contributing.

    Thanks a lot, I really appreciate it.

  • V-yubandi-msft's avatar
    V-yubandi-msft
    4 months ago

    Hi fabricpribeiro ,
    1. The Virtual Network Data Gateway is an Azure resource created in the Azure portal. It is designed specifically for Fabric/Power BI connectivity, not as a VPN gateway. Once deployed, you link it to your Fabric workspace and set it up to connect to your SQL Managed Instance using its private endpoint.

     

    2. For identity, it’s best to use a Service Principal rather than a workspace identity. This prevents the gateway from being tied to a personal account and allows for better management.

    In SQL MI, grant the Service Principal connect  permission and roles such as db_datareader and db_datawriter, based on your mirroring requirements.

    In Fabric, assign Contributor or Admin rights so it can manage the connection through the gateway.

     

    Traffic between Fabric and SQL MI is encrypted in transit using TLS, and SQL MI uses Transparent Data Encryption for data at rest. The VNet gateway keeps traffic within Azure’s backbone network, offering improved security and lower latency compared to an on premises gateway.


    Helpful documents

    Create virtual network (VNet) data gateways | Microsoft Learn

    What is a virtual network (VNet) data gateway | Microsoft Learn

     

    Hope this helps please let us know if you need any additional details.