Azure Kubernetes Service (AKS) / Azure SQL Managed Instance: AKS nodes cannot connect to SQL MI via VNet-local endpoint

Question

Azure Kubernetes Service (AKS) / Azure SQL Managed Instance: AKS nodes cannot connect to SQL MI via VNet-local endpoint

Le Van Khoa 1

Service Azure Kubernetes Service (AKS), Azure SQL Managed Instance (SQL MI)

Scenario Pods/nodes on our AKS cluster are trying to connect to an Azure SQL Managed Instance in the same VNet. The intended connection path is via the VNet-local endpoint (Redirect connection policy, TCP 1433 / 11000-11999).

Result Only the AKS nodes/pods fail to connect to the SQL MI VNet-local endpoint. Regular VMs in the same VNet (both in the same subnet as AKS and in other subnets) can connect to the same Azure SQL MI VNet-local endpoint without any issue.

Environment

AKS: outbound connection from node pool / pods
SQL MI: deployed in a dedicated (delegated) subnet, connection type is Redirect
Testing was done using kubectl debug to access an AKS-managed node and attempt the connection from there

Troubleshooting steps already taken The following test cases have been performed:

Test case	Connection path	Result
Create a VM in the same subnet as AKS and connect	VNet-local EP	Success ○
Create a VM in a different subnet and connect	VNet-local EP	Success ○
Use kubectl debug to access an AKS-managed node and connect	VNet-local EP	Failure ✕

Network-related resources (route tables, NSGs, etc.) have also been reviewed, and no explicit blocking rule was found. We have not been able to identify the root cause so far.

Question Could you help us identify the root cause and the resolution needed so that AKS can successfully connect to Azure SQL MI via the VNet-local endpoint?

RakeshReddy Gurram 5 Reputation points Microsoft External Staff Moderator

2026-07-24T07:09:04.13+00:00

Hi Le Van Khoa,

Welcome to the Microsoft Q&A Platform and thank you for submitting your query here.

Could you please review the private message and let us know.
RakeshReddy Gurram 5 Reputation points Microsoft External Staff Moderator

2026-07-24T10:09:17.5733333+00:00
Hi Le Van Khoa,

The test results indicate that the Azure SQL Managed Instance VNet-local endpoint is reachable, since regular VMs in the same VNet—including a VM in the AKS subnet—can connect successfully. This suggests the issue is not with SQL Managed Instance itself but is confined to the AKS node/pod outbound connectivity path.

For a SQL Managed Instance VNet-local endpoint using the Redirect connection type, clients must connect through the SQL MI FQDN and be able to resolve the SQL MI DNS name and reach the SQL MI subnet on TCP 1433.

To pinpoint where traffic is being blocked, please validate the following from both an AKS pod and the AKS node debug session:

nslookup <sql-mi-fqdn>

nc -vz <sql-mi-fqdn> 1433

nc -vz <resolved-sql-mi-private-ip> 1433

Please also compare the effective routes and NSG rules on the AKS VMSS node NIC with those on the working VM NIC.

If AKS is using UDR, firewall/NVA, kubenet, network policies, or a service mesh, make sure traffic from the AKS node/pod source path is permitted to reach the SQL MI subnet on TCP 1433. Microsoft AKS outbound troubleshooting guidance also recommends checking DNS resolution, endpoint reachability, NSG, firewall/proxy, routing, and network policy when outbound connectivity from AKS fails.

At this point, the most likely fix is to correct the AKS-side DNS, routing, NSG, firewall/NVA, or Kubernetes network policy settings that are blocking connectivity from AKS to SQL MI.

Please refer:

Azure SQL Managed Instance connection types

Azure SQL Managed Instance connectivity architecture

Troubleshoot AKS outbound connections

Troubleshoot AKS connections to endpoints outside the virtual network

Your answer

RakeshReddy Gurram 5 Reputation points Microsoft External Staff Moderator

2026-07-24T07:09:04.13+00:00

Hi Le Van Khoa,

Welcome to the Microsoft Q&A Platform and thank you for submitting your query here.

Could you please review the private message and let us know.
RakeshReddy Gurram 5 Reputation points Microsoft External Staff Moderator

2026-07-24T10:09:17.5733333+00:00

Hi Le Van Khoa,

The test results indicate that the Azure SQL Managed Instance VNet-local endpoint is reachable, since regular VMs in the same VNet—including a VM in the AKS subnet—can connect successfully. This suggests the issue is not with SQL Managed Instance itself but is confined to the AKS node/pod outbound connectivity path.

For a SQL Managed Instance VNet-local endpoint using the Redirect connection type, clients must connect through the SQL MI FQDN and be able to resolve the SQL MI DNS name and reach the SQL MI subnet on TCP 1433.

To pinpoint where traffic is being blocked, please validate the following from both an AKS pod and the AKS node debug session:

nslookup <sql-mi-fqdn>

nc -vz <sql-mi-fqdn> 1433

nc -vz <resolved-sql-mi-private-ip> 1433

Please also compare the effective routes and NSG rules on the AKS VMSS node NIC with those on the working VM NIC.

If AKS is using UDR, firewall/NVA, kubenet, network policies, or a service mesh, make sure traffic from the AKS node/pod source path is permitted to reach the SQL MI subnet on TCP 1433. Microsoft AKS outbound troubleshooting guidance also recommends checking DNS resolution, endpoint reachability, NSG, firewall/proxy, routing, and network policy when outbound connectivity from AKS fails.

At this point, the most likely fix is to correct the AKS-side DNS, routing, NSG, firewall/NVA, or Kubernetes network policy settings that are blocking connectivity from AKS to SQL MI.

Please refer:

Azure SQL Managed Instance connection types

Azure SQL Managed Instance connectivity architecture

Troubleshoot AKS outbound connections

Troubleshoot AKS connections to endpoints outside the virtual network