Microsoft Purview Managed Integration Runtime for Azure SQL
Short answer
Use the Managed Virtual Network Integration Runtime with managed private endpoints to scan Azure SQL databases securely without deploying infrastructure.
Question
You have an Azure subscription that contains multiple Azure SQL databases and multiple instances of SQL Server on Azure Virtual Machines.
You need to scan all the Azure SQL resources in the subscription by using Microsoft Purview. The solution must minimize administrative effort and maximize security.
What should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The key trap is choosing a self-hosted runtime; the correct answer leverages the fully managed runtime with private endpoints to avoid infrastructure management and public exposure.
Learn how to configure Microsoft Purview to scan Azure SQL databases using the Managed Virtual Network Integration Runtime for minimal admin effort and maximum security.
Common mistake: Selecting the Self-Hosted Integration Runtime because it seems more flexible, failing to recognize that the 'minimize administrative effort' constraint favors the fully managed service which requires no VM patching or maintenance.
Expert Analysis
To scan Azure SQL resources within a subscription using Microsoft Purview while minimizing administrative effort and maximizing security, the correct configuration relies on the Managed Virtual Network Integration Runtime. This component is fully managed by Microsoft, eliminating the need to deploy, patch, or maintain infrastructure for scanning tasks, which directly satisfies the requirement to minimize administrative overhead.
For security, the Managed Virtual Network Integration Runtime can utilize managed private endpoints to connect to supported Azure Platform-as-a-Service (PaaS) sources like Azure SQL Database. This ensures that scanning traffic remains within the Microsoft backbone network or uses private connectivity, preventing data exposure over the public internet and protecting against data exfiltration. While SQL Server on Azure VMs might require an Self-Hosted Integration Runtime if they are not accessible via managed endpoints, the prompt specifically highlights Azure SQL databases as the target for this specific constraint-driven selection, where the managed option is superior.
The alternative of using a Self-Hosted Integration Runtime would require provisioning and securing virtual machines, increasing administrative effort and potentially exposing scanning agents to broader network risks unless heavily isolated. Therefore, selecting the Managed Virtual Network Integration Runtime with its associated managed connectivity features is the optimal choice for balancing low maintenance with high security standards in a modern Azure governance context.
Exam Strategy
When exam questions emphasize 'minimizing administrative effort' for managed services, prioritize fully managed integration components over self-hosted alternatives. Look for keywords like 'fully managed,' 'no VM required,' or 'private endpoints' as indicators for the preferred secure and low-maintenance solution.
Frequently Asked Questions
Why is the Managed Virtual Network Integration Runtime better for security?
Does the Managed Integration Runtime support Azure SQL Databases?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
AllanHouston 👍 1This one seems contentious. Azure SQL databases: Managed virtual network IR A Managed virtual network integration runtime is fully managed by Microsoft Purview, so no scanning VM needs to be deployed or patched. It can use managed private endpoints to reach supported Azure PaaS sources such as Azure SQL Database, keeping scanning traffic on private connectivity and protecting against data exfiltration. This balances minimal administration with maximum security. The ordinary Azure integration runtime would require less initial configuration, but it is intended for sources with publicly accessible endpoints. That minimizes administration but does not maximize security as strongly as disabling public access and using a private endpoint. SQL Server on Azure VMs: Self-hosted IR A SQL Server instance hosted on an Azure VM is an IaaS source inside a virtual network. A self-hosted integration runtime can be installed on a Windows VM with private connectivity to all the SQL Server VMs. Microsoft documents self-hosted IR as the runtime for sources inside an on-premises network or Azure virtual network. A Purview managed private endpoint is not created directly to the SQL Server engine running inside an ordinary Azure VM, so Managed virtual network IR is not the appropriate selection for that row.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →