Skip to main content
This guide is for Azure SQL Database. For other databases in a private Azure network, follow the Azure Private Link guide.
Omni can connect to your Azure SQL Database via Azure Private Link. In this configuration, Omni establishes an encrypted connection from our network to your network via a private endpoint connection.

​
Limitations

Azure SQL Managed Instance isn’t currently supported. Contact Omni support if you need to connect a managed instance.

​
Requirements

To follow the steps in this guide, you’ll need Organization Admin permissions in Omni, plus the following in Azure:
  • An Azure SQL logical server
  • Permissions that allow you to create Private Link services
  • Permissions that allow you to view and change the server’s connection policy

​
Connection policy

Your logical server’s connection policy must be Proxy or Default. It must not be Redirect. Omni reaches your database through your Private Link service, which forwards only the ports defined by its load balancing rules. Under the Redirect policy the SQL gateway accepts the connection on port 1433 and then hands the client a node address on ports 11000-11999, which your Private Link service doesn’t publish. The connection fails at this second step. Most servers don’t require a change; a private endpoint left on Default already behaves as Proxy on port 1433. To check the current setting, open your server in the Azure portal under Networking > Connectivity, or run:
If it returns Redirect, change it to Proxy:
If the policy was set to Redirect before the private endpoint was created, you may need to toggle it after the endpoint exists for the change to take effect.

​
Setup

2

Contact Omni support

After you finish setting up the Private Link service, contact Omni support with the following information:
  • Your Azure SQL Server hostname, which ends with .database.windows.net. For example, omni-blobsrus-admin.database.windows.net.
    Omni connects to your server’s regular fully qualified domain name, <server>.database.windows.net and resolves it privately from our network. Connections addressed to the private IP or to <server>.privatelink.database.windows.net fail by design - the private endpoint routes traffic to the SQL gateway, which needs the real FQDN to route the login.
  • The resource ID or alias of your Private Link service:
    • The resource ID contains /providers/Microsoft.Network/privateLinkServices/. For example, /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Network/privateLinkServices/<service-name>
    • The alias ends with .azure.privatelinkservice. For example, pls-name.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.region.azure.privatelinkservice
  • The port your database will be listening on, typically 1433
  • Technical contact details, in case of connection difficulties

​
What’s next?

After you contact Omni support with the information in step 2, Omni will create a private endpoint connection that connects to your service to support the connection to the database. Unless you’ve added Omni’s subscription to your Private Link service’s auto-approval list, you’ll need to approve the connection request. Omni will contact you to approve it. Once this is complete, Omni support will add the new database connection to your Omni instance. The connection can then be used like any other database connection. You’ll need to provide your Microsoft SQL Server authentication credentials when setting up the connection in Omni.