SQL Server migration in Azure Arc (#35736)

* SQL Server migration in Azure Arc

* pencil edit

---------

Co-authored-by: Stacy Chambers <102548089+Stacyrch140@users.noreply.github.com>

Author: MashaMSFT

azure-sql/includes/sql-managed-instance/azure-sql-managed-instance-link-check-network.md

@@ -18,6 +18,11 @@ To use the SQL Agent to test network connectivity, you need the following requir
 - The user doing the test must have [permissions to create a job](/sql/ssms/agent/configure-a-user-to-create-and-manage-sql-server-agent-jobs) (either as a **sysadmin** or belongs to the SQLAgentOperator role for `msdb`) for both SQL Server and SQL Managed Instance. 
 - The SQL Server Agent service must be [running](/sql/ssms/agent/start-stop-or-pause-the-sql-server-agent-service) on SQL Server. Since the Agent is on by default on SQL Managed Instance, no additional action is necessary.
 
+Consider the following:
+- To avoid false negatives, all firewalls along the network path must allow Internet Control Message Protocol (ICMP) traffic.
+- To avoid false positives, all firewalls along the network path must allow traffic on the proprietary SQL Server UCS protocol. Blocking the protocol can lead to a successful connection test, but the link fails to create.
+- Advanced firewall setups with packet-level guardrails in place need to be properly configured to properly allow traffic between SQL Server and SQL Managed Instance.
+
 
 ### [SSMS](#tab/ssms)
 

azure-sql/managed-instance/managed-instance-link-configure-how-to-scripts.md

@@ -321,7 +321,13 @@ FROM BINARY = <PublicKey>
 
 Importing Azure-trusted root certificate authority (CA) keys to SQL Server is required for your SQL Server to trust the SQL Managed Instance public key certificates issued by Azure.
 
-You can download the necessary root CA keys from [Root Certificate Authorities](/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list). Save them locally, such as to the sample `C:\Path\To\<name of certificate>.crt` path, and then import the certificates from that path:
+You can download the necessary root CA keys from [Azure Certificate Authority details](/azure/security/fundamentals/azure-ca-details#root-certificate-authorities). At minimum, download the **DigiCert Global Root G2** and **Microsoft RSA Root Certificate Authority 2017** certificates and import them to your SQL Server instance. However, if you plan to run the link for longer than a few months, then download and import all 7 certificates listed in the [Root Certificate Authorities](/azure/security/fundamentals/azure-ca-details#root-certificate-authorities) section to avoid potential disruptions in case Azure updates its trusted CA list.
+
+> [!NOTE]
+> The root certificate in the certification path for a SQL Managed Instance public key certificate is issued by an Azure trusted root Certificate Authority (CA). The specific root CA can change over time as Azure updates its trusted CA list.
+> For a simplified setup, install all root CA certificates listed in [Azure Root Certificate Authorities](/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list). You can install just the required CA key by identifying the issuer of a previously imported SQL Managed Instance public key.
+
+Save the certificates local to the SQL Server instance, such as to the sample `C:\Path\To\<name of certificate>.crt` path, and then import the certificates from that path by using the following Transact-SQL script. Replace `<name of certificate>` with the actual certificate name, such as `DigiCert Global Root G2` or `Microsoft RSA Root Certificate Authority 2017`.
 
 ```sql
 -- Run on SQL Server
@@ -343,8 +349,8 @@ GO
 ```
 
 > [!NOTE]
-> The root certificate in the certification path for a SQL Managed Instance public key certificate is issued by an Azure trusted root Certificate Authority (CA). The specific root CA can change over time as Azure updates its trusted CA list.
-> For a simplified setup, install all root CA certificates listed in [Azure Root Certificate Authorities](/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list). You can install just the required CA key by identifying the issuer of a previously-imported SQL Managed Instance public key.
+> The `sp_certificate_add_issuer` stored procedure missing from your SQL Server environment indicates your SQL Server instance doesn't have the [appropriate service update installed](managed-instance-link-feature-overview.md#version-supportability). 
+
 
 Finally, verify all the created certificates by using the following dynamic management view (DMV):
 

azure-sql/managed-instance/managed-instance-link-feature-overview.md

@@ -50,19 +50,21 @@ You can use databases that are replicated through the link between SQL Server an
 
 ## Version supportability
 
-Both the General Purpose and Business Critical service tiers of Azure SQL Managed Instance support the Managed Instance link. The link feature works with the Enterprise, Developer, and Standard editions of SQL Server. 
+Both the General Purpose and Business Critical service tiers of Azure SQL Managed Instance support the Managed Instance link. The link feature works with the Enterprise, Developer, and Standard editions of SQL Server.  
+
+One-way replication from SQL Server to Azure SQL Managed Instance is generally available for every supported SQL Server version. Disaster recovery with two-way replication and failback is supported starting with SQL Server 2022, and is based on the [update policy](update-policy.md) your SQL managed instance is configured with.
 
 The following table lists the functionality of the link feature and the minimum supported SQL Server versions:
 
-| Initial primary version  | Operating system (OS)  | One-way replication |  Disaster recovery options |  Servicing update requirement |
-| --- | --- | --- | --- | --- |
-| Azure SQL Managed Instance |  [Windows Server](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server-2022#operating-system-support) and [Linux](/sql/linux/sql-server-linux-setup#supported-platforms) for the secondary SQL Server instance replica | Generally available |  [Bi-directional](#disaster-recovery) |  - [SQL Server 2022 CU10 (KB5031778)](/troubleshoot/sql/releases/sqlserver-2022/cumulativeupdate10): Creating a link from Azure SQL Managed Instance to SQL Server 2022 <sup>1</sup> <br /> - [SQL Server 2022 CU13 (KB5036432)](/troubleshoot/sql/releases/sqlserver-2022/cumulativeupdate13): Failing over the link using [Transact-SQL](managed-instance-link-failover-how-to.md?tabs=tsql#fail-over-a-database) <br /> - Configuring a link *from* Azure SQL Managed Instance to SQL Server 2025 is only supported by instances configured with the [**SQL Server 2025 update policy**](update-policy.md#sql-server-2025-update-policy) <br /> - Configuring a link *from* Azure SQL Managed Instance to SQL Server 2022 is only supported by instances configured with the [**SQL Server 2022 update policy**](update-policy.md#sql-server-2022-update-policy) | 
-| SQL Server 2025 (17.x) | [Windows Server](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server-2025#operating-system-support) and [Linux](/sql/linux/sql-server-linux-setup#supported-platforms) | Preview | From SQL Server to SQL MI only |  [SQL Server 2025](/sql/sql-server/sql-server-2025-release-notes) |
-| SQL Server 2022 (16.x) | [Windows Server](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server-2022#operating-system-support) and [Linux](/sql/linux/sql-server-linux-setup#supported-platforms) |  Generally available |  [Bi-directional](#disaster-recovery) |  - SQL Server 2022 RTM: Creating a link from SQL Server 2022 to Azure SQL Managed Instance <br /> - [SQL Server 2022 CU13 (KB5036432)](/troubleshoot/sql/releases/sqlserver-2022/cumulativeupdate13): Failing over the link using [Transact-SQL](managed-instance-link-failover-how-to.md?tabs=tsql#fail-over-a-database) | 
-| SQL Server 2019 (15.x) | [Windows Server only](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server-2019) | Generally available | From SQL Server to SQL MI only | [SQL Server 2019 CU20 (KB5024276)](https://support.microsoft.com/topic/kb5024276-cumulative-update-20-for-sql-server-2019-4b282be9-b559-46ac-9b6a-badbd44785d2) |
-| SQL Server 2017 (14.x) | [Windows Server only](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server#operating-system-support-for-sql-server-2017) | Generally available | From SQL Server to SQL MI only | The most recent [SQL Server 2017 CU31](/troubleshoot/sql/releases/sqlserver-2017/cumulativeupdate31) build and the matching [SQL Server 2017 Azure Connect pack](/troubleshoot/sql/releases/sqlserver-2017/azureconnect) build | 
-| SQL Server 2016 (13.x) | [Windows Server only](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server#operating-system-support-for-sql-server-2017) | Generally available | From SQL Server to SQL MI only| The most recent [SQL Server 2016 SP3](/troubleshoot/sql/releases/sqlserver-2016/build-versions#sql-server-2016-service-pack-3-sp3-cumulative-update-cu-builds) build and the matching [SQL Server 2016 Azure Connect pack](/troubleshoot/sql/releases/sqlserver-2016/build-versions#sql-server-2016-service-pack-3-sp3-azure-connect-pack-builds) build |
-| SQL Server 2014 (12.x) and earlier | N/A | N/A | N/A | Versions before SQL Server 2016 aren't supported.|
+| Initial primary version  | Operating system (OS)  |  Disaster recovery options |  Minimum required servicing update |
+| --- | --- | --- | --- |
+| Azure SQL Managed Instance |  [Windows Server](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server-2022#operating-system-support) and [Linux](/sql/linux/sql-server-linux-setup#supported-platforms) for the secondary SQL Server instance replica |  [Bi-directional](#disaster-recovery) | Configuring a link *from* Azure SQL Managed Instance to, and bidirectional failover with, is supported by:  <br /> - SQL Server 2025 and SQL MI with the [**SQL Server 2025 update policy**](update-policy.md#sql-server-2025-update-policy) <br /> - SQL Server 2022 and SQL MI with the [**SQL Server 2022 update policy**](update-policy.md#sql-server-2022-update-policy)  | 
+| SQL Server 2025 (17.x) | [Windows Server](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server-2025#operating-system-support) and [Linux](/sql/linux/sql-server-linux-setup#supported-platforms) |  [Bi-directional](#disaster-recovery)|  [SQL Server 2025 RTM (17.0.1000.7)](/sql/sql-server/sql-server-2025-release-notes) |
+| SQL Server 2022 (16.x) | [Windows Server](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server-2022#operating-system-support) and [Linux](/sql/linux/sql-server-linux-setup#supported-platforms) |  [Bi-directional](#disaster-recovery) |  - [SQL Server 2022 RTM (16.0.1000.6)](/sql/sql-server/sql-server-2022-release-notes): Creating a link *from* SQL Server 2022 to SQL MI <br /> -  [SQL Server 2022 CU10 (16.0.4095.4)](/troubleshoot/sql/releases/sqlserver-2022/cumulativeupdate10): Creating a link *from* SQL MI to SQL Server 2022<sup>1</sup> <br /> - [SQL Server 2022 CU13 (16.0.4125.3)](/troubleshoot/sql/releases/sqlserver-2022/cumulativeupdate13): Failing over the link using [Transact-SQL](managed-instance-link-failover-how-to.md?tabs=tsql#fail-over-a-database) | 
+| SQL Server 2019 (15.x) | [Windows Server only](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server-2019) | From SQL Server to SQL MI only | [SQL Server 2019 CU20 (15.0.4312.2)](https://support.microsoft.com/topic/kb5024276-cumulative-update-20-for-sql-server-2019-4b282be9-b559-46ac-9b6a-badbd44785d2) |
+| SQL Server 2017 (14.x) | [Windows Server only](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server#operating-system-support-for-sql-server-2017) | From SQL Server to SQL MI only | [SQL Server 2017 CU31 (14.0.3456.2)](/troubleshoot/sql/releases/sqlserver-2017/cumulativeupdate31) and the matching [SQL Server 2017 Azure Connect pack (14.0.3490.10)](/troubleshoot/sql/releases/sqlserver-2017/azureconnect) | 
+| SQL Server 2016 (13.x) | [Windows Server only](/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server#operating-system-support-for-sql-server-2017) | From SQL Server to SQL MI only| [SQL Server 2016 SP3 (13.0.6300.2)](/troubleshoot/sql/releases/sqlserver-2016/build-versions#sql-server-2016-service-pack-3-sp3-cumulative-update-cu-builds) and the matching [SQL Server 2016 Azure Connect pack (13.0.7000.253)](/troubleshoot/sql/releases/sqlserver-2016/build-versions#sql-server-2016-service-pack-3-sp3-azure-connect-pack-builds) |
+| SQL Server 2014 (12.x) and earlier | N/A | N/A | Versions before SQL Server 2016 aren't supported.|
 
 <sup>1</sup> While creating a link with SQL Server 2022 as the initial primary is supported starting with the RTM version of SQL Server 2022, creating a link with Azure SQL Managed Instance as the initial primary is supported only starting with SQL Server 2022 CU10. If you create the link from a SQL Managed Instance initial primary, downgrading SQL Server below CU10 isn't supported while the link is active as it can cause issues after failing over in either direction.   
 
@@ -115,14 +117,16 @@ The Managed Instance link enables [disaster recovery](managed-instance-link-disa
 
 With SQL Server 2016 to SQL Server 2019, the primary is always SQL Server and failover to the secondary SQL managed instance is one-directional. Failing back to SQL Server isn't supported. However, you can recover your data to SQL Server by using data movement options such as [transactional replication](replication-transactional-overview.md) or [exporting a bacpac](../database/database-export.md). 
 
-With SQL Server 2022, either SQL Server or SQL Managed Instance can be the initial primary and you can establish the link from either SQL Server or SQL Managed Instance. You can fail back your workloads between the primary and secondary, achieving true two-way disaster recovery. 
+With SQL Server 2022 and SQL Server 2025, either SQL Server or SQL Managed Instance (with a matching [update policy](update-policy.md)) can be the initial primary and you can establish the link from either SQL Server or SQL Managed Instance. You can fail back your workloads between the primary and secondary, achieving true two-way disaster recovery. 
 
 When failing back to SQL Server, you can choose to fail back: 
 -  _online_ by using the Managed Instance link directly. 
--  _offline_ by taking a backup of your database from SQL Managed Instance and [restoring it to your SQL Server 2022 instance](restore-database-to-sql-server.md). 
+-  _offline_ by taking a backup of your database from SQL Managed Instance and [restoring it to your SQL Server instance](restore-database-to-sql-server.md). 
 
 :::image type="content" source="media/managed-instance-link-feature-overview/disaster-recovery-scenario.png" alt-text="Diagram showing the disaster recovery scenario.":::
 
+
+
 ## Use Azure services
 
 Use the link feature to take advantage of Azure services by using SQL Server data without migrating it to the cloud. Examples include reporting, analytics, backups, machine learning, and other jobs that send data to Azure.