Using DAC (Dedicated Admin Connection) with a SQL Server Managed Instance

Question

Using DAC (Dedicated Admin Connection) with a SQL Server Managed Instance

Daniel Warne 0

Hi,

Azure SQL Managed instances

Is it possible to use DAC with a SQL Managed instance? If so how? Does it need to be on a vm that is within the same vnet as the managed instance? Is it possible to use the DAC from my remote laptop which connects to our azure subscriptions via VPN.

Thanks

Daniel

0 comments

2 answers

Your answer

Answer 1

Manoj Kumar Boyini 17,950 Microsoft External Staff Moderator

Hi @Daniel Warne

Yes, Dedicated Administrator Connection (DAC) is supported for Azure SQL Managed Instance.

However, there is an important limitation: DAC listens on port 1434, while Azure SQL Managed Instance private endpoints only support port 1433. Because of this, DAC cannot be used through a private endpoint. To use DAC, the client must have connectivity through the Managed Instance's VNet-local endpoint and be able to reach the Managed Instance from the same VNet (or through appropriate network routing such as VPN/ExpressRoute into that VNet).

You can connect using:

SSMS: admin:<managed-instance-name>
sqlcmd: sqlcmd -A -S <managed-instance-name>

If your laptop connects to the Azure VNet through a Site-to-Site VPN, Point-to-Site VPN, or ExpressRoute and has proper DNS resolution and network connectivity to the Managed Instance, you may be able to use DAC directly from your laptop. Otherwise, using a VM within the same VNet is a common approach.

**References:
**https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/diagnostic-connection-for-database-administrators?view=sql-server-ver17
https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/private-endpoint-overview?view=azuresql&tabs=separate-vnets

Hope this helps, Please let us know if you have any questions.

Manoj Kumar Boyini 17,950 Reputation points Microsoft External Staff Moderator

2026-06-27T07:11:23.8466667+00:00

Hi @Daniel Warne

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.
Daniel Warne 0 Reputation points

2026-06-29T11:26:12.5866667+00:00

Thank you for your responses. On a managed instance, is it possible that the DAC listens on a different port range? The reason for this question is that if I run the following command:

EXEC xp_readerrorlog 0, 1, N'Dedicated admin connection';

I get different results and they all appear to be in the 11000-11100 range. For example:

"Dedicated admin connection support was established for listening remotely on port 11001."
Manoj Kumar Boyini 17,950 Reputation points Microsoft External Staff Moderator

2026-06-29T15:50:03.2733333+00:00

Hi @Daniel Warne

Yes, this is expected behavior. Although TCP port 1434 is the default DAC port, SQL Server can dynamically assign a different port during startup. The SQL Server error log is the authoritative source for identifying the active DAC listener port. Therefore, seeing a message such as "Dedicated admin connection support was established for listening remotely on port 11001" indicates that your Managed Instance is currently using a dynamically assigned DAC port. This behavior is expected and does not, by itself, indicate a configuration or connectivity issue.

To use DAC with Azure SQL Managed Instance, the client must have direct network connectivity to the Managed Instance VNet (for example, from a VM in the same VNet or through VPN/ExpressRoute with appropriate routing and DNS). Additionally, DAC is not supported over a Private Endpoint.
Manoj Kumar Boyini 17,950 Reputation points Microsoft External Staff Moderator

2026-07-01T07:59:20.1033333+00:00

Hi @Daniel Warne

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar questions will benefit by doing so. Your contribution is highly appreciated.

Answer 2

Bruce (SqlWork.com) 84,251

Yes it’s supported, but there is no public access. You must connect from the same vlan as the managed instance. This basically means you need a VM hosted on the same Vlan, and you can connect from this host.

0 comments