SQL Server MI Fabric Mirroring Security question - TDA

At a TDA level, you can describe the security of the SQL Server Managed Instance (SQL MI) to Microsoft Fabric mirroring solution in terms of identity, access control, data protection, and platform-managed security. The integration uses Microsoft Entra ID–based service principal authentication to enable secure service-to-service communication between SQL MI and Fabric, eliminating the need for embedded credentials or SQL authentication. Access is governed through Role-Based Access Control (RBAC) and database-level permissions, following the principle of least privilege, where the service principal is granted only the minimum permissions required to perform mirroring and synchronization activities.

From a data protection perspective, all data transmitted between SQL Managed Instance and Microsoft Fabric is encrypted in transit using TLS 1.2 or higher, ensuring confidentiality and integrity over the network. Data at rest is protected through platform-managed encryption mechanisms, including Transparent Data Encryption (TDE) in SQL MI and Microsoft-managed encryption within Fabric storage. The mirroring capability itself is a platform-managed service, meaning synchronization and data movement are handled internally by Fabric’s managed infrastructure, reducing the need for custom integration components and minimizing the attack surface. If SQL MI is deployed within a virtual network, network boundary protections such as private connectivity and controlled outbound access further strengthen the overall security posture.

Thank you.