> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omni.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to Azure SQL Database with Azure Private Link

> Connect Omni to an Azure SQL Database over a private network using an Azure Private Link service.

<Note>
  This guide is for **Azure SQL Database**. For other databases in a private Azure network, follow the [Azure Private Link guide](/connect-data/azure-privatelink).
</Note>

Omni can connect to your Azure SQL Database via Azure Private Link. In this configuration, Omni establishes an encrypted connection from our network to your network via a private endpoint connection.

## Limitations

Azure SQL Managed Instance isn't currently supported. Contact Omni support if you need to connect a managed instance.

## Requirements

To follow the steps in this guide, you'll need **Organization Admin** permissions in Omni, plus the following in Azure:

* An Azure SQL logical server
* Permissions that allow you to create Private Link services
* Permissions that allow you to view and change the server's connection policy

### Connection policy

Your logical server's connection policy must be **Proxy** or **Default**. It must not be **Redirect**.

Omni reaches your database through your Private Link service, which forwards only the ports defined by its load balancing rules. Under the **Redirect** policy the SQL gateway accepts the connection on port `1433` and then hands the client a node address on ports `11000-11999`, which your Private Link service doesn't publish. The connection fails at this second step.

Most servers don't require a change; a private endpoint left on **Default** already behaves as **Proxy** on port `1433`.

To check the current setting, open your server in the Azure portal under **Networking > Connectivity**, or run:

```bash theme={null}
az sql server conn-policy show \
  --resource-group <resource-group> \
  --server <server-name>
```

If it returns `Redirect`, change it to `Proxy`:

```bash theme={null}
az sql server conn-policy update \
  --resource-group <resource-group> \
  --server <server-name> \
  --connection-type Proxy
```

<Note>
  If the policy was set to **Redirect** before the private endpoint was created, you may need to toggle it after the endpoint exists for the change to take effect.
</Note>

## Setup

<Steps>
  <Step title="Set up a Private Link service in your Azure account" titleSize="h3">
    In your Azure account, expose your Azure SQL server through a Private Link service in your virtual network.

    Omni's subscription ID is:

    ```text theme={null}
    081a7a2c-5971-4342-ac5e-bf9e4d8235b0
    ```

    Add this subscription ID to your Private Link service's:

    * **Visibility list**- Controls who can find the service
    * **Auto-approval list** - **Optional.** Controls whether Omni's endpoint connects without requiring your approval. Omni always creates its endpoint as a manual connection request, so without the auto-approval entry you'll need to manually approve it.

    Additionally, verify that traffic from the Private Link service to your database is allowed. As Private Link traffic is internal to the network, Omni's public IP addresses don't apply.
  </Step>

  <Step title="Contact Omni support" titleSize="h3">
    After you finish setting up the Private Link service, contact Omni support with the following information:

    * **Your Azure SQL Server hostname**, which ends with `.database.windows.net`. For example, `omni-blobsrus-admin.database.windows.net`.

          <Note>
            Omni connects to your server's regular fully qualified domain name, `<server>.database.windows.net` and resolves it privately from our network. Connections addressed to the private IP or to `<server>.privatelink.database.windows.net` fail by design - the private endpoint routes traffic to the SQL gateway, which needs the real FQDN to route the login.
          </Note>
    * **The resource ID or alias of your Private Link service**:
      * The resource ID contains `/providers/Microsoft.Network/privateLinkServices/`. For example, `/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Network/privateLinkServices/<service-name>`
      * The alias ends with `.azure.privatelinkservice`. For example, `pls-name.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.region.azure.privatelinkservice`
    * The port your database will be listening on, typically `1433`
    * Technical contact details, in case of connection difficulties
  </Step>
</Steps>

## What's next?

After you contact Omni support with the information in step 2, Omni will create a private endpoint connection that connects to your service to support the connection to the database.

Unless you've added Omni's subscription to your Private Link service's auto-approval list, you'll need to approve the connection request. Omni will contact you to approve it.

Once this is complete, Omni support will add the new database connection to your Omni instance. The connection can then be used like any other database connection. You'll need to provide your [Microsoft SQL Server authentication credentials](/connect-data/setup/microsoftsql#setup) when setting up the connection in Omni.