Azure Databricks Serverless Compute Unable to Connect to Azure SQL MI Using Failover Group FQDN via

[LokeshChikuru]

We are using Azure Databricks Serverless Compute to connect to Azure SQL Managed Instance (SQL MI) through Network Connectivity Configuration (NCC) with Private Endpoint Rules. Connectivity works successfully when using the primary SQL MI FQDN. However, connectivity fails when the SQL Managed Instance is configured behind a Failover Group and the connection is attempted using the Failover Group listener FQDN. As a result, Databricks Serverless Compute is currently unable to establish a connection to Azure SQL MI via the Failover Group FQDN, while direct connections to the primary SQL MI endpoint continue to work as expected.

[balajij8]

Hi Lokesh,

Its likely tied to how Azure Databricks Network Connectivity Configurations handle DNS resolution and Private Endpoint routing relative to Azure SQL Managed Instance Failover Groups.

When you connect using the primary SQL MI FQDN, compute routes directly through the NCC Private Endpoint created for that specific resource ID. However, the Failover Group listener FQDN acts as a DNS abstraction layer across instances. Because NCC Private Endpoint rules are provisioned against specific target Azure Resource IDs and FQDNs, the compute environment cannot automatically resolve or route the Failover Group listener FQDN through the instance's private endpoint.

• DNS Private Zone Resolution - Failover Group listeners require the private DNS zone (database.windows.net) to maintain proper records mapping both the primary SQL MI and the Failover Group listener to the appropriate private endpoint IP.
• NCC Private Endpoint Scope - An NCC rule targeting only the primary SQL MI resource ID does not inherently intercept and route traffic for the Failover Group listener FQDN unless the alias is explicitly accounted for in the DNS path and endpoint definition.
• Cross-Region Architecture - If the secondary SQL MI instance is located in a secondary region, private endpoint routing becomes more complex and typically requires dedicated NCC configurations for each region's endpoint. 

You can try below

• Configure Private DNS Zone Records - Ensure the Azure Private DNS Zone for database.windows.net contains A records (or CNAMEs) for both primary instance and Failover Group listener. Both must resolve to the respective private IP of the active SQL MI Private Endpoint within your network.
• Align NCC Private Endpoint Rules - Check whether the NCC Private Endpoint rule can be configured to include the Failover Group listener domain name alongside the SQL MI resource, ensuring the Databricks Serverless DNS proxy correctly directs traffic across the private link.
• Direct Primary FQDN (Fallback) - If DNS routing for the listener cannot be resolved through NCC in the current setup, connecting directly to the primary SQL MI FQDN will maintain connectivity, though failover events will require updating the connection target.