After someone deleted platform NSG rules and forced all MI subnet traffic through a firewall without documented exceptions, the Managed Instance lost management connectivity. What should the security engineer restore, and which port applies if a public endpoint is truly required?
Select an answer to reveal the explanation.
Short Explanation
MI subnets have a required NSG/UDR choreography—put it back. If you really must open a public endpoint, it’s TCP 3342 from known sources, not wide-open 1433.
Full Explanation
Azure SQL Managed Instance subnets require documented NSG rules and UDR patterns; removing platform allowances breaks management and data-plane connectivity. When a public endpoint is intentionally enabled, network controls should allow TCP 3342 only from known sources. Opening TCP 1433 from the Internet is the wrong public-endpoint model for MI. Entra database authentication is Domain 3 and does not replace subnet NSG/UDR requirements. Application Gateway WAF is an HTTP(S) edge control, not a substitute for MI subnet platform rules.