Virtual Network Flow logs for Azure SQL Managed Instance Virtual Network.,

Hi @Justin_MSCloud,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

We understand that even after enabling the Virtual Network Flow logs for Azure SQL Managed Instance integrated Virtual Network, the flow logs are not getting captured in Storage account and is causing issues.

Considerations for virtual network flow logs:

Storage account:

Location:

• The storage account must be in the same region as the virtual network.

Subscription:

• The storage account must be in the same subscription of the virtual network.
• If the storage account is in a different subscription, the resource that you're logging (virtual network, subnet, or network interface) and the storage account must be associated with the same Microsoft Entra tenant. The account you use for each subscription must have the necessary permissions.

Performance tier:

• The storage account must be standard. Premium storage accounts aren't supported.

Self-managed key rotation:

• If you change or rotate the access keys to your storage account, virtual network flow logs stop working. To fix this problem, you must disable and then re-enable virtual network flow logs.
• Reference: https://zcusa.951200.xyz/en-us/azure/network-watcher/vnet-flow-logs-overview#considerations-for-virtual-network-flow-logs

Flow Logs Configuration:

• Please verify that you have correctly enabled the Virtual Network Flow logs on the specific Virtual Network you want to monitor.
• Please check whether you have correctly configured Network Watcher to capture flow logs for the virtual network. Double-check the settings in the Azure Network Watcher for the virtual network and subnet where your SQL Managed Instance resides.
• Reference: https://zcusa.951200.xyz/en-us/azure/network-watcher/vnet-flow-logs-portal#enable-a-flow-log
• Microsoft.Insights provider must be registered to successfully log traffic flowing through a virtual network. If you aren't sure if the Microsoft.Insights provider is registered, check its status in the Azure portal by following the below document.
• Reference: https://zcusa.951200.xyz/en-us/azure/network-watcher/vnet-flow-logs-portal#prerequisites
• Please verify if virtual network flow logs are properly configured or not.
• Reference: https://zcusa.951200.xyz/en-us/azure/network-watcher/vnet-flow-logs-portal#create-a-flow-log

Private Endpoint Traffic:

• If you are trying to capture traffic to a private endpoint, note that traffic cannot be recorded at the private endpoint itself. Instead, you should capture traffic at the source VM.
• The traffic is recorded with source IP address of the VM and destination IP address of the private endpoint. You can use PrivateEndpointResourceId field to identify traffic flowing to a private endpoint.

Verify the VNet Integration:

• Please make sure that your Azure SQL Managed Instance is correctly integrated with the virtual network and that it is associated with a subnet. The subnet should be properly configured for monitoring.

Check the Log Retention Policy:

• Logs are collected at one-minute intervals through the Azure platform.
• Check the log retention settings in the Storage Account. If the retention is set too short or if it’s not configured correctly, older logs might not be visible.
• NOTE: Retention time for the logs is only available with Standard general-purpose v2 storage accounts.

Check NSG Rules:

• All traffic flows in your network are evaluated through the applicable network security group rules or Azure Virtual Network Manager security admin rules.
• Please check if any of the NSG rules configured are blocking the traffic.

Reference: https://zcusa.951200.xyz/en-us/azure/network-watcher/vnet-flow-logs-overview#how-logging-works

Kindly let us know if the above helps or you need further assistance on this issue.

If this answers your query, please do click **Accept Answer** and 'Upvote' so that other community members facing the same issues can find the right answers. And, if you have any further query do let us know. We are pleased to assist you.

Regards,

Sai prasanna.

Verify the VNet Integration:

• Please make sure that your Azure SQL Managed Instance is correctly integrated with the virtual network and that it is associated with a subnet. The subnet should be properly configured for monitoring.

All the mentioned settings are properly set but still the flow logs are not captured.
Not sure if the Virtual Network flow logs are not supported for SQL Managed Instance VNet.

Hi @Justin_MSCloud,

We appreciate your feedback and apologize for not providing a satisfactory answer to your query earlier.

Please attempt to deploy a virtual machine (VM) and verify whether the traffic is successfully passing through and check if the flow logs are being captured for the VM. If this process works for the VM but not for the SQL instance, then issue is with SQL Managed Instance.

Kindly let us after testing with a VM to confirm if the flow logs are being captured.

Thanks,

Sai.

Yes VNet Flow logs are getting captured for VM's it only the Azure managed instances VNet that are not capture. Is the VNet flow logs for Azure SQL managed instance Vnet supported?