Data Mission Sync connects to your Azure SQL Database over the public internet. Your Azure SQL Server must be configured to allow public access, with the Data Mission Sync static IP address added to your firewall allow-list. Each region uses a dedicated NAT Gateway with a static IP that will not change.
Why Static IPs?
Unlike services that use dynamic IP ranges, Data Mission Sync uses Azure NAT Gateways to provide a single, static IP address per region. This allows you to create precise firewall rules rather than opening access to broad IP ranges, improving your security posture.
Static IP Addresses by Region
Add the IP address for your selected region to your Azure SQL Server firewall rules:
| Region | Azure Location | Static IP Address |
| Canada Central | canadacentral | (Shown in profile settings) |
| East US | eastus2 | (Shown in profile settings) |
| West US | westus2 | (Shown in profile settings) |
| North Europe | northeurope | (Shown in profile settings) |
| UK South | uksouth | (Shown in profile settings) |
| The static IP address for your selected region is displayed in the Data Mission Sync Control Plane when you configure your profile. Use this IP address when setting up your firewall rules. | ||
Configuring Azure SQL Firewall
Follow these steps to add the Data Mission Sync IP address to your Azure SQL firewall:
1. Navigate to your SQL Server (not the database) in the Azure Portal.
2. Select Networking from the left menu under Security.
3. Under Public access, ensure 'Selected networks' is chosen.
4. Under Firewall rules, click + Add a firewall rule.
5. Enter a rule name (e.g., 'DataMissionSync-CanadaCentral').
6. Enter the static IP address for your region in both Start IP and End IP fields.
7. Click Save.
Common Firewall Errors
| Error Message | Solution |
| Cannot open server 'yourserver' requested by the login. Client with IP address 'x.x.x.x' is not allowed to access the server. | Add the IP address shown in the error message to your firewall rules. Verify you're using the correct static IP for your profile's region. |
| A network-related or instance-specific error occurred while establishing a connection to SQL Server. | Check that the server name is correct (yourserver.database.windows.net) and that the firewall rule is active. |
Network Connectivity Requirements
| Public access is currently required. Data Mission Sync connects to your Azure SQL Database over the public internet using static IP addresses. Your Azure SQL Server must be configured for public access with the Data Mission Sync IP address allow-listed in your firewall rules. |
Private connectivity options such as Azure Private Endpoint or VNet peering are not currently supported.
Roadmap: Customer-Hosted Agent
For customers who require their Azure SQL Database to remain completely private (no public access), a customer-hosted agent is on our roadmap. This lightweight agent would be deployed inside your Azure VNet, connecting privately to your Azure SQL via Private Endpoint while communicating outbound to the Data Mission Sync control plane.
If private connectivity is a requirement for your organization, please contact us to discuss your needs and timeline.
Testing Connectivity
After configuring your firewall rules, use the Test Connection button in Data Mission Sync to verify connectivity. The test will confirm that the service can reach your Azure SQL Database using the configured credentials and firewall rules.