# Deploy or connect an Azure MSSQL database with a discovered network.

## How to add  a Microsoft.Sql service endpoint and disable network policy to a discovered subnet

## Overview

Tuono has the ability to discover an existing network and subnet in your infrastructure and deploy or connect to an Azure MSSQL database. Since we treat discovered networks as [read only objects](https://tuono.gitbook.io/userguide/cloud-provisioning/blueprints/authoring/existing-infrastructure) you are required to configure the network manually to prepare it for database usage.

Azure MSSQL requires the following subnet configuration that will not automatically be configured in a read only network.

1. Subnet with a 'Microsoft.Sql/managedInstances' endpoint.
2. Subnet with `privateEndpointNetworkPolicies` disabled

## Error message

When attempting to deploy a Microsoft Azure MSSQL database to a discovered network you will receive the following errors:

**Service Endpoint missing**

```
Apply DB in azure :: end :: failure

error in managed.database.<DATABASE_NAME>

Subnet <SUBNET_NAME> must have a 'Microsoft.Sql' service endpoint.

Add a Microsoft.Sql service endpoint to the subnet, or do not make the subnet readonly.
```

### **Network policy enabled**

```
Apply mssql in azure :: end :: failure

error in compute.nic.<NIC_NAME>

Subnet <SUBNET_NAME> cannot have private endpoints with network policies enabled.

Disable private endpoint network policies for the subnet, or do not make the subnet readonly.
```

## Resolution

Execute the following azure cli commands to configure the targeted subnet.

1. Open an Azure shell console <https://shell.azure.com/>.
2. Set your [account subscription](https://docs.microsoft.com/en-us/cli/azure/account?view=azure-cli-latest#az_account_set) in cloud shell

```
az account set --subscription <mysubscription>
```

1. Add a `Microsoft.SQL` endpoint to your subnet by executing a [subnet update](https://docs.microsoft.com/en-us/cli/azure/network/vnet/subnet?view=azure-cli-latest) command in cloud shell.

```
az network vnet subnet update --name <SUBNET_NAME> --resource-group <RESOURCE_GROUP_NAME> --vnet-name <vNET_NAME> --service-endpoints "Microsoft.Sql"
```

4.[ Disable network policies](https://docs.microsoft.com/en-us/azure/private-link/disable-private-endpoint-network-policy) for private endpoints.

```
az network vnet subnet update --name <SUBNET_NAME> --resource-group <RESOURCE_GROUP_NAME> --vnet-name <vNET_NAME> --disable-private-endpoint-network-policies true
```

1. Re-run the Tuono job.
