Cloud SQL for SQL Server release notes

Beginning April 12, 2027, you won't be able to create new instances of Cloud SQL for SQL Server 2017. Starting on October 13, 2027, SQL Server 2017 will reach end of life (EOL) and Microsoft will stop releasing security updates. Cloud SQL for SQL Server will stop supporting SQL Server 2017 after this date.

For more information, see Database versions and version policies.

Regional endpoints (REP) are now generally available (GA) for the Cloud SQL for SQL Server Admin API.

Regional endpoints let you interact with Cloud SQL for SQL Server instances using regionalized URLs (such as sqladmin.{region}.rep.googleapis.com) rather than through a single global endpoint.

Regional endpoints provide regional frontend and load balancing infrastructure that improves data residency by keeping network traffic within the same region as the instance. This reduces the instance's dependency on global frontend infrastructure.

Regional endpoints have strong regional isolation, so the failure of a load balancer or frontend in one region doesn't affect any other region. Regional service load balancers have a separate, regionally isolated control plane.

Regional endpoints are designed to meet stringent data residency and sovereignty standards, such as ITAR and Assured Workloads Regions, ensuring data in transit remains within the committed region.

Certificate management and TLS termination occurs within each region, on the regional load balancer, so data remains encrypted until it reaches its destination region and stays within that region while being processed there.

Cloud SQL for SQL Server supports the sp_help_revlogin stored procedure in the msdb database. You can enable this stored procedure by configuring the cloud sql enable sp_help_revlogin database flag to export SQL Server logins, password hashes, and security identifiers (SIDs) when migrating databases or synchronizing logins.

For more information, see Export SQL Server logins and Configure database flags.

Cloud SQL for SQL Server now supports connecting to instances with write endpoints using the Cloud SQL Auth Proxy or Cloud SQL language connectors. When you configure the proxy or a language connector with a write endpoint DNS name, connections are redirected automatically to the new primary instance during replica failover or switchover.

For more information, see Connect to an instance using a write endpoint.

The C4 machine series is now available for Cloud SQL for SQL Server Enterprise Plus instances in the following regions:

• africa-south1 — Johannesburg
• asia-northeast3 — Seoul
• asia-south2 — Delhi
• europe-west6 — Zürich
• southamerica-west1 — Santiago
• us-west3 — Salt Lake City

The C4 machine series provides the following benefits:

• Supports fifth and sixth generation Intel Xeon Scalable processors.
• Offers a price-performance balance that makes it suitable for high-demand workloads.

Cloud SQL supports in-place upgrades and downgrades to your instance's infrastructure. You can change all of the following in place:

• The edition that your Cloud SQL instance uses.
• The machine type.
• The storage type.
• The database version.

Making in-place changes is the most direct and least error-prone way to reconfigure an instance.

For more information about in-place upgrades and downgrades, see Upgrade in place.

Cloud SQL now makes it easier to configure Private Service Connect for your Cloud SQL instance. When you create an instance that's enabled with Private Service Connect, you can choose to automatically create the service connection policy and endpoint in the VPC network that you want to use with Private Service Connect.

For more information, see Configure Private Service Connect.

You can now use the update_user tool in the Cloud SQL remote MCP server to update passwords for Cloud SQL for SQL Server database users.

For more information, see Available tools.

The Cloud SQL remote MCP server now supports specialized endpoint URLs (toolsets) for /readonly and /instance_manage. Specialized toolset URLs let you restrict the set of exposed MCP tools based on your security and workflow requirements.

For more information, see Available toolsets.

Newly created instances configured with high availability (HA) now have Knowledge Catalog (formerly Dataplex Universal Catalog) enabled by default.

Cloud SQL for SQL Server instances send updates and metadata to Knowledge Catalog to help support data discovery.

You can either verify enablement or disable the feature using the Google Cloud console.

For more information, see Manage your Cloud SQL resources using Knowledge Catalog.

DNS automation is now generally available (GA) on Cloud SQL instances where Private Service Connect is enabled.

You can use DNS automation to provision and manage per-instance DNS records automatically. On Enterprise Plus edition instances where DNS automation is enabled, you can also enable a global write endpoint DNS that automatically resolves to your current primary instance.

You can change the backup plan for your Cloud SQL enhanced backups without first removing the existing plan. For more information, see Change your instance's associated backup plan.

Starting on August 1, 2026, when you create or clone a Cloud SQL instance enabled with Private Service Connect, or when you enable Private Service Connect for an existing instance, then connection reconciliation behavior is enabled by default and can't be disabled.

When you remove a project from the list of allowed projects, all existing Private Service Connect connections from the removed project are immediately closed (reconciled). This means that applications using Private Service Connect endpoints in those removed projects can't continue to connect to the Cloud SQL instance using those endpoints.

For more information, see Allowed Private Service Connect projects.

Cloud SQL for SQL Server now supports executing SQL statements using the Cloud SQL Data API.

Cloud SQL for SQL Server now supports significantly faster re-encryption of instances and replicas protected by customer-managed encryption keys (CMEKs), and re-encryption now completes with zero downtime. The steps to re-encrypt your instances and replicas are unchanged, but the operation now re-encrypts the underlying disks in-place, without creating re-encryption backups.

For more information, see Re-encrypt an existing CMEK-enabled instance or replica.

Cloud SQL now supports Private Service Connect outbound connectivity on the following additional types of instances:

• Read replica instances.

• Instances that use advanced disaster recovery features such as switchover and failover operations.

• Primary instances that have replicas.

For more information about Private Service Connect outbound connectivity see About Private Service Connect.

Customer-managed encryption key (CMEK) support for Cloud SQL enhanced backups is generally available. You can protect your CMEK-enabled Cloud SQL instances using Google Cloud Backup and DR Service.

For more information, see Choose your backup option.

The command for upgrading Cloud SQL instances to the new network architecture has been re-enabled.

For more information, see Upgrade an instance to the new network architecture.

Cloud SQL for SQL Server now supports regional endpoints for the Cloud SQL Admin API. This feature lets you direct your API calls to a region-specific endpoint. Using a regional endpoint enhances data locality and helps meet strict compliance expectations.

This feature includes: * Regional boundary restrictions: Cloud SQL regional endpoints enforce strict matching. The region of the target API resource must match the region of the endpoint exactly. Otherwise, the request is rejected with a 4xx error. * Restricted API visibility: When you use a regional endpoint, the Instance.List API only returns resources located within that specific region.

For more information, see Cloud SQL regional endpoints.

This feature is in Preview.

Cloud SQL for SQL Server now supports PolyBase (GA).

With PolyBase, your Cloud SQL for SQL Server instance uses Transact-SQL (T-SQL) commands to directly query data stored in external data sources as if the data is stored in local tables. You don't need to install separate client connection software.

For more information, see About PolyBase.

If a specific active query is blocked or running much longer than expected, it can block other dependent queries. Cloud SQL for SQL Server offers an optional feature that lets you view and terminate blocking queries.

For more information, see Blocked active queries (Preview).

You can use the Database Insights remote MCP server to analyze Cloud SQL for SQL Server's performance and system metrics. This feature is in GA.

Newly created Cloud SQL instances are integrating with Knowledge Catalog (formerly Dataplex Universal Catalog) for data discovery. As part of this automatic enablement, we will send metadata to Knowledge Catalog. You can verify if your instance is enabled for integration with Knowledge Catalog by looking at the configuration pane in the Knowledge Catalog console. If you don't want your instance to be integrated with Knowledge Catalog, you can turn off this feature.

For more information, see Create a new instance with Knowledge Catalog integration enabled.

You can now integrate Cloud SQL for SQL Server with Vertex AI and third-party models (Preview).

By integrating your Cloud SQL for SQL Server instance with Vertex AI, you can generate vector embeddings from models hosted in Vertex AI directly from your Cloud SQL instance.

Cloud SQL for SQL Server supports model endpoints from the following sources:

• Vertex AI
• Hugging Face
• OpenAI

For more information, see Integrate Cloud SQL for SQL Server with Vertex AI.

You can use DNS automation on Cloud SQL instances where Private Service Connect is enabled to provision and manage per-instance DNS records automatically. On Enterprise Plus edition instances where DNS automation is enabled, you can also enable a global write endpoint DNS that automatically resolves to your current primary instance.

This feature is in Preview.

The Cloud SQL remote MCP server is generally available (GA). The Cloud SQL remote MCP server lets you interact easily with Cloud SQL instances from LLMs, AI applications, and AI-enabled development platforms.

As of April 10, 2026, you can create, run, and edit Gemini Cloud Assist investigations only if you have a Premium Support contract. You can use Gemini Cloud Assist investigations to monitor and troubleshoot your Cloud SQL instance with AI assistance.

If you ran an investigation prior to April 10, 2026, then the results of the investigation continue to be available to you in the Google Cloud console.

If the storage capacity of a Cloud SQL instance is larger than your application needs, then you can manually reduce, or shrink, your storage capacity to a smaller size.

Depending on underlying disk size, storage shrink operations might incur considerable downtime. If your instance requires limited downtime, rather than using storage shrink capabilities, we recommend migrating your data to a new, smaller instance using Database Migration Service.

For more information, see About storage shrink.

Cloud SQL for SQL Server now supports SQL Server 2025 (GA):

• SQL Server 2025 Standard
• SQL Server 2025 Enterprise
• SQL Server 2025 Express

For more information, see Database versions and version policies and Choose a machine series.

Cloud SQL for SQL Server integration with Microsoft Entra ID (GA) provides centralized identity and access management (IAM) for your databases using your existing Microsoft Entra ID tenant.

Cloud SQL for SQL server read pools are now generally available and provide operational simplicity and scaling for your read workloads.

Read pools provide a single endpoint in front of up to seven read pool nodes and automatically load balance traffic.

You can scale your read pool in several ways:

• Scale in or out: scale load balancing capacity horizontally by modifying the number of read pool nodes in the read pool. Each read pool supports between 1 and 7 read pool nodes.

• Scale up or down: scale load balancing capacity vertically by modifying the machine type associated with a read pool node. Once defined, configuration is uniformly applied across each read pool node in the read pool.

For more information, see About read pools.

Cloud SQL supports cross-project PITR operations for instances protected by backup and DR (GA).

This feature lets you restore a Cloud SQL instance to a project other than the project where either the source instance or the backup vault is located.

For more information, see Perform a cross-project PITR.

Point-in-time recovery (PITR) default enablement behavior has changed:

• PITR is now enabled by default when you create a Cloud SQL Enterprise edition instance in the Google Cloud console.
• PITR is enabled by default when you create a Cloud SQL Enterprise Plus edition instance, regardless of the method used.

For more information, see Configure point-in-time recovery (PITR).

Multi-region backup vaults for Cloud SQL enhanced backups are generally available (GA).

This feature lets you store your backup data in multi-region storage locations, providing higher availability and protection against regional outages.

For more information, see Enhanced backups.

You can now enable automatic server certificate rotation for your Cloud SQL instance. This feature is specifically designed for instances utilizing the Certificate Authority Service (CAS). Automatic server certificate rotation helps you maintain high security standards while removing the operational burden of manual rotation.

For more information about enabling automatic server certificate rotation for your instance, see Enable automatic server certificate rotation.

Gemini Cloud Assist investigation capabilities are now supported in Cloud SQL for SQL Server (Preview).

For more information, see Troubleshoot slow queries with AI assistance.

After March 17, 2026, when you enable the Cloud SQL Admin API (sqladmin.googleapis.com), the Cloud SQL remote MCP server is enabled automatically.

The Cloud SQL remote MCP server is in Preview.

Control of MCP use with organization policies is deprecated. After March 17, 2026, organization policies that use the gcp.managed.allowedMCPServices constraint won't work, and you can control MCP use with IAM deny policies. For more information about controlling MCP use, see Control MCP use with IAM.

New best practices are available for securing generative AI agents using Model Context Protocol (MCP) with Google Cloud databases. This guide covers key security measures like least privilege, native database controls, and secure agent design to help you build safer AI applications. For more information, see Best practices for securing agent interactions with Model Context Protocol.

You can now use the Cloud SQL remote MCP server. The Cloud SQL remote MCP server lets you interact easily with Cloud SQL instances from LLMs, AI applications, and AI-enabled development platforms.

This feature is in Preview.

You can now update the server certificate authority (CA) mode of an existing Cloud SQL instance. You can update existing instances that use the per-instance CA option (GOOGLE_MANAGED_INTERNAL_CA) to use the shared CA option (GOOGLE_MANAGED_CAS_CA) or the customer-managed CA option (CUSTOMER_MANAGED_CAS_CA).

For more information about the different server CA mode options, see Certificate authority (CA) hierarchies.

Cloud SQL enhanced backups are now generally available (GA).

With enhanced backups, backups are managed and stored in a centralized backup management project that leverages the Backup and DR service, and provides enforced retention, granular scheduling, and longer retention.

Enhanced backups now also support point-in-time-recovery (PITR) after instance deletion.

For more information about the available options and their limitations, see Backup options. For more information about enhanced backups pricing, see Backup and DR pricing.