Action required: WFM Database Connectivity

This topic explains the details your IT team needs to know to ensure continued connectivity if your organization fits the conditions mentioned in this article.

Purpose

Calabrio is implementing an infrastructure change requiring internal services to make private connections to Azure SQL databases for improved security, performance, and reliability.

Potential impact

Implementations using Azure Private Endpoints /Azure Private Link may experience failed DNS resolution for Calabrio database connections used by the following:

• CRA (Custom Reporting Access)
• Teleopti Log Server (TLS)
• Other direct-to-database integrations (if applicable)

Root cause (summary)

When connecting to Azure SQL, DNS may resolve as shown below.

.database.windows.net

• → CNAME to .privatelink.database.windows.net
• → ultimately to .database.windows.net

If your environment uses Private Endpoints, DNS resolution may be attempted locally and not route to the internet, causing a connection failure.

How to determine if you're impacted

You are likely impacted if both of the following are true.

• You connect to Calabrio databases from your environment using CRA and/or TLS (direct DB connectivity)
• Your environment uses Azure Private Endpoints /Private Link for other applications or services

Non-impacted scenario

If you do not use Private Endpoints in your environment, database connectivity should not be affected. This change impacts only direct database connectivity to Calabrio Azure SQL instances. This change does not impact the following.

• SaaS web login
• Web UI access
• Agent desktop functionality
• Standard browser-based reporting

Only direct SQL integrations (such as CRA and TLS) are affected.

Required remediation (what to change)

Solution

Your network team must add an exception for Calabrio’s Azure SQL private link endpoints so that connections route correctly (as in, they are not trapped by local/private DNS resolution).

NOTE   Exact implementation depends on your DNS architecture (Azure Private DNS zones, custom DNS, conditional forwarders, and more). The goal is to ensure Calabrio database connections can resolve and route as intended.

Change classification

• Type: Infrastructure networking change
• Customer action required: Yes (only if you are using Private Endpoints)
• Expected downtime: None if configured correctly in advance
• Rollback: No rollback planned to legacy routing after cutover
• Effective date: April 6, 2026

Network requirements

• Protocol: TCP
• Port: 1433 (Azure SQL default)
• Outbound connectivity must be allowed from CRA/TLS hosts to the following.
  • .database.windows.net
• Ensure firewall and proxy configurations allow this traffic.

DNS configuration guidance

One of the following approaches is typically required:

• Remove or exclude Calabrio SQL FQDNs from private DNS zone overrides
• Configure conditional forwarding for Calabrio SQL domains
• Create explicit DNS record exceptions to allow public resolution
• Ensure no private endpoint exists for the same SQL FQDN

The objective is to ensure Calabrio SQL endpoints resolve via public Azure DNS, not the customer’s Private Link DNS zone.

Private link by region

Region	Public endpoint	Private endpoint
Central United States	centralus.database.windows.net	centralus.privatelink.database.windows.net
West United States	ybae15lcwu.database.windows.net	ybae15lcwu.privatelink.database.windows.net
West Europe	wtknv2nkr0.database.windows.net	wtknv2nkr0.privatelink.database.windows.net

(Add/remove regions as needed and ensure the public endpoint values match your current environment.)

Validation steps (simple, practical checks)

After implementing the exception, do the following.

• Confirm DNS resolution for the Calabrio SQL server resolves correctly from the CRA/TLS host
• Confirm connectivity (test connection/application test) succeeds during the maintenance window or ahead of it

We’re making an improvement to Calabrio’s cloud infrastructure to enhance the security, performance, and reliability of our WFM platform.

IMPORTANT   This message is informational for you, but the required change must be completed by your IT/security/network team (not typical end users/admins). The change should require less than 30 minutes of work. To make this easy, we’ve included short technical instructions and steps for your IT/security/network team in the section above.

Who may be impacted

You could be impacted by this change because:

• You use CRA and/or Teleopti Log Server (TLS) to connect directly to Calabrio databases, and

• Your organization might use Azure Private Endpoints /Azure Private Link for other services in your environment

If that combination applies, the upcoming change may cause integrations to fail or CRA to become unavailable unless your network team adds a specific exception.

What’s changing (high-level)

DNS resolution for some Azure SQL databases may return a privatelink CNAME. In environments that use Private Endpoints, DNS resolution can be attempted locally and never reach public Azure DNS, resulting in a connection failure.

What we need from you

Please share this article with your IT/security/network team and ask them to complete the steps by April 5, 2026.

Action deadline: April 5, 2026

If you’re not sure who to send it to, forwarding to your team responsible for IT-related networking and security is usually best.

Key dates

• Action deadline: April 5, 2026

• Change deployment window: April 6, 2026

• Expected impact: No disruption if the change is completed by the deadline; otherwise, your integrations could be at risk of failing, especially for CRA/TLS database connections.

Need help?

Calabrio can’t confirm whether your network team has set up Private Endpoints /Private Link in your environment. This is why it is important for you to share this article with your network team.

If you need our assistance, please reach out to Calabrio Support.

Email: [email protected]