More Secure SQL Server on VM DB (CDC) source to an eventstream directions?

Thankyou, lbendlin, for your response.

Hi FrankFromHR,

We appreciate your inquiry through the Microsoft Fabric Community Forum.

Based on my understanding, exposing port 1433 to the public is a potential security risk. Currently, Microsoft Fabric Eventstreams require the source to be accessible from Fabric’s public infrastructure, as VNet integration or Private Endpoints are not yet supported for Eventstream connections.

Kindly follow the steps below which may help you establish a secure and controlled connection without broadly exposing your server, thereby resolving the issue:

1. You may restrict access to your SQL Server by configuring your firewall or Network Security Group (NSG) to allow inbound access on port 1433 only from Fabric’s IP ranges. This will ensure that only Microsoft Fabric can connect, and general internet traffic will be blocked.
2. For enhanced security, we recommend adopting a push-based architecture. In this approach, your SQL Server (CDC) changes can be securely pushed to Azure Event Hub, which then feeds into Fabric Eventstream. This method eliminates the need to expose the SQL Server port and ensures full security through Azure networking.
   You can use tools such as Kafka Connect or Logic Apps to extract the CDC changes and send them securely to Azure Event Hub, followed by connecting Fabric Eventstream to that Event Hub.

If you find our response helpful, we kindly request you to mark it as the accepted solution and provide kudos. This will assist other community members facing similar issues.

Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.