Hotspot Question You have an Azure subscription that contains an Azure SQL managed instance named SQL1. You use the Microsoft Power BI service. You need to configure connectivity from the Power BI ser

Question

Exhibit

Answer Area

• Endpoint type:
  PrivatePublicService
• Control connections by using:
  A database-level firewallA network security group (NSG)A server-level firewallVirtual network firewall rules

Explanation

This question tests knowledge of how to securely connect the Power BI service to an Azure SQL Managed Instance, ensuring only Power BI can initiate connections using a private, controlled endpoint.

Approach. For the endpoint type, you should use a Public endpoint on SQL1. Azure SQL Managed Instance supports a public endpoint specifically designed for PaaS services like Power BI to connect to it, since Power BI is a cloud service that cannot reach a private VNet endpoint directly without additional network infrastructure. To control connections and ensure only the Power BI service can initiate them, you should use a Network Security Group (NSG) rule that restricts inbound access to the public endpoint to only the Power BI service tag ('PowerBI'). This combination allows Power BI to connect while blocking all other unauthorized sources, satisfying the requirement that only the Power BI service can initiate connections.

Concept tested. Azure SQL Managed Instance connectivity options - specifically the use of the public endpoint for PaaS/cloud service integration, and using NSG rules with Azure service tags to restrict access to only the Power BI service. Private endpoints cannot be used directly by the Power BI service without a VPN or ExpressRoute, making the public endpoint with NSG restrictions the correct architecture.

Reference. https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/public-endpoint-configure?view=azuresql

No community discussion yet for this question.