Fix it now
The replica you reached is not offering that database for queries. Error 976 is published as the target database participating in an availability group and currently not accessible for queries, which covers both a secondary role that allows no connections and data movement that is suspended. Error 35250 is the neighbouring case: the connection to the primary is not active.
SELECT ar.replica_server_name, ars.role_desc,
ar.secondary_role_allow_connections_desc
FROM sys.availability_replicas ar
JOIN sys.dm_hadr_availability_replica_states ars
ON ar.replica_id = ars.replica_id;
SELECT DB_NAME(database_id), is_suspended, suspend_reason_desc,
synchronization_state_desc, redo_queue_size
FROM sys.dm_hadr_database_replica_states;
- Read the first result.
NOin the secondary role column is the whole answer: that replica accepts no connections at all when it is a secondary, which is the documented default. - Change it if that is wrong:
ALTER AVAILABILITY GROUP [AG1] MODIFY REPLICA ON N'NODE2' WITH (SECONDARY_ROLE (ALLOW_CONNECTIONS = READ_ONLY));. The accepted values areNO,READ_ONLYandALL. - Read the second result. A suspended database gives you the documented reason directly, and the reason decides whether resuming is safe or will simply fail again.
- Connect through the listener with
ApplicationIntent=ReadOnly, which is whatREAD_ONLYrequires, rather than connecting to the replica by name. - If you get 35250 instead, the secondary has lost its link to the primary. Check the endpoint and the network path before changing any replica setting.
Reading through the listener needs two things that are configured separately: the group must have a listener, and read-only routing must be configured. Setting the replica alone leaves you landing on the primary.
If read-intent connections now reach the secondary, stop here. If the setting will not stick, the last section covers the edition boundary.
Why it happens
A secondary database is continuously applying log records sent from the primary. To let readers in at the same time, SQL Server runs their statements against row versions rather than blocking them behind redo. Readability is therefore a deliberate setting rather than a default: it changes how the replica behaves and adds versioning overhead on the primary.
Two settings control access and they are easy to confuse. The replica’s secondary role decides whether it accepts connections at all: NO is documented as the default and means the secondary databases are not available for read access, READ_ONLY admits only connections whose application intent is ReadOnly, and ALL admits any connection but still only for reading. Separately, the primary’s read-only routing list decides where a read-intent connection arriving at the listener is actually sent. Get one right and not the other and you land on the primary, or on a replica that turns you away with 976.
The other three codes describe the group failing rather than refusing, and two of them are routinely described wrongly. Error 35250 is published as the connection to the primary replica not being active, so the command cannot be processed. Error 983 is published as being unable to access an availability database because the database replica is not in the PRIMARY or SECONDARY role, and telling you to try again later; it is a role message, and a cluster problem is only one of the things that can put a replica outside those roles.
Error 35262 is the one worth unlearning. Its published text says that the default startup of the database is being skipped because the database belongs to an availability group, that the availability group will start it, that this is an informational message only, and that no user action is required. It appears in the log every time an availability database starts. Treating it as evidence of a fault sends people to the cluster team over a routine line in the error log.
The secondary is not configured to accept connections
You have this one if The replica query shows NO in the secondary role column, and every attempt fails the same way.
- Set the secondary role to
READ_ONLYso only connections declaring read intent are admitted. - Prefer
READ_ONLYoverALL, so an application that has not declared its intent cannot land there by accident. - Re-run the replica query and confirm the setting changed before testing again.
Read-only routing is incomplete
You have this one if The replica is readable when you connect to it by name, but connections through the listener still land on the primary.
- Give each replica a routing URL for when it is a secondary:
MODIFY REPLICA ON N'NODE2' WITH (SECONDARY_ROLE (READ_ONLY_ROUTING_URL = N'TCP://node2.contoso.local:1433')). - Give each replica a routing list for when it is primary:
MODIFY REPLICA ON N'NODE1' WITH (PRIMARY_ROLE (READ_ONLY_ROUTING_LIST = (N'NODE2', N'NODE1'))). - Confirm the group has a listener, then connect to the listener with
ApplicationIntent=ReadOnly.
Routing is evaluated per role, so configure both roles on every replica. A replica with no list configured for the primary role routes nothing after a failover.
Data movement is suspended
You have this one if The database exists on the secondary but is_suspended is 1, often after a disk-full event or a manual suspend during maintenance.
- Read
suspend_reason_descfirst.SUSPEND_FROM_USERmeans somebody did it;SUSPEND_FROM_REDO,SUSPEND_FROM_APPLYandSUSPEND_FROM_UNDOmean an error, and the error log has it. - Resume with
ALTER DATABASE [YourDb] SET HADR RESUME;and watch the redo queue drain. - If it will not resume, remove the database from the group on that replica, restore it again from backups and rejoin it.
The secondary cannot reach the primary
You have this one if Error 35250, with the replica showing as disconnected in the state DMVs.
- Check the mirroring endpoint is started on both sides and note its port.
- Test the path from the secondary to the primary on that port and open it if the test fails.
- Confirm each instance’s service account has a login on the other with connect permission on the endpoint.
The group is a basic availability group
You have this one if The configuration looks right, the syntax is rejected or the setting will not stick, and the instances are Standard edition.
- Confirm what you are running with
SELECT SERVERPROPERTY('Edition'), SERVERPROPERTY('ProductVersion'); - A basic availability group is documented as having no read access on the secondary replica, so point reporting at the primary or at a separate copy.
- Where reporting genuinely needs its own copy, consider log shipping to a standby database, or plan an edition change.
Full reference
Matching the symptom to the setting
| What you observe | What it points at |
|---|---|
| 976 on every connection to the secondary | The secondary role is set to NO |
| 976 only when read intent is not declared | The secondary role is READ_ONLY, which is the recommended setting |
| Reads work but the data is stale | Movement is suspended, or the redo queue is behind |
| 35250 on the secondary | The link to the primary is not active: endpoint, firewall or permission |
| 983 during a failover | The replica is not in the PRIMARY or SECONDARY role; retry once the role settles |
| 35262 in the log | Informational. The availability group is starting the database, as designed |
The two role settings, side by side
| Setting | Values | Effect |
|---|---|---|
SECONDARY_ROLE (ALLOW_CONNECTIONS = ...) |
NO, READ_ONLY, ALL |
NO is the default and refuses connections; READ_ONLY admits only ReadOnly intent; ALL admits any connection, read-only |
SECONDARY_ROLE (READ_ONLY_ROUTING_URL = ...) |
TCP://host:port or NONE |
Where to send read-intent traffic when this replica is a secondary |
PRIMARY_ROLE (READ_ONLY_ROUTING_LIST = ...) |
A list of instances, or NONE |
Where this replica sends read-intent traffic when it is the primary |
PRIMARY_ROLE (ALLOW_CONNECTIONS = ...) |
READ_WRITE, ALL |
Whether the primary itself accepts read-intent connections |
Reading a suspended database honestly
sys.dm_hadr_database_replica_states publishes a reason for every suspension, and resuming without reading it is how the same outage happens twice in an afternoon.
| suspend_reason_desc | Means |
|---|---|
SUSPEND_FROM_USER |
Somebody suspended data movement deliberately |
SUSPEND_FROM_PARTNER |
Suspended after a forced failover |
SUSPEND_FROM_REDO |
An error during the redo phase; the error log has it |
SUSPEND_FROM_APPLY |
An error writing the log to file |
SUSPEND_FROM_CAPTURE |
An error capturing the log on the primary |
SUSPEND_FROM_UNDO |
An error during the undo phase |
SUSPEND_FROM_RESTART |
Suspended before the database was restarted |
What the synchronisation state is telling you
The documented values are NOT SYNCHRONIZING, SYNCHRONIZING, SYNCHRONIZED, REVERTING and INITIALIZING. A readable secondary sitting at SYNCHRONIZING with a large redo queue is readable and behind, which is a different conversation with the report’s owner than a replica that will not accept connections at all. Check the redo queue before you promise anyone current figures.
Backups and integrity checks on a secondary
- Taking backups on a secondary is one of the common reasons to make one readable, and it is one of the things a basic availability group is documented as not supporting.
- Integrity checks on secondary replicas are also outside what a basic availability group offers.
- A basic availability group is documented as two replicas with a single database, and it cannot be upgraded in place to an advanced availability group; it has to be dropped and recreated.
- Multiple basic availability groups can exist on one instance, which is how sites cover several databases inside the limit.
When a licence is the actual fix
Most cases of 976 are a replica setting or a missing routing list, and those cost nothing to correct. The edition only becomes the answer once you have proved the configuration is right. In SQL Server 2025 the full availability group feature is listed as Enterprise, with support for up to eight secondary replicas including five synchronous ones, and it is what readable secondaries, backups on a secondary and multi-database groups come from. Standard offers a basic availability group, documented as two replicas with one database, no read access on the secondary and no backups on the secondary. There are legitimate free alternatives for reporting, including running the report on the primary or keeping a standby with log shipping. Where those genuinely do not fit, Arco supplies SQL Server 2025 Enterprise (2-core pack) licences and can confirm how many core packs each server needs before anything is ordered.
Every code this article covers
| Code | What it points at | Source |
|---|---|---|
976 |
The target database is participating in an availability group and is currently not accessible for queries | Microsoft Learn |
35250 |
The connection to the primary replica is not active, so the command cannot be processed | Microsoft Learn |
983 |
Unable to access the availability database because the database replica is not in the PRIMARY or SECONDARY role; try the operation again later | Microsoft Learn |
35262 |
Informational: default startup of the database is skipped because it belongs to an availability group, which will start it. No user action is required | Microsoft Learn |
Confirm the fix worked
- The replica query reports
READ_ONLYorALLfor the secondary role on the replica you intend to read. - A connection through the listener with read intent returns the secondary’s name from
SELECT @@SERVERNAME;. sys.dm_hadr_database_replica_statesshows the database synchronising and not suspended.- The redo queue is draining rather than growing while the report runs.
- A representative report returns row counts you can reconcile against the primary.
Questions people ask about this
Do I need read-only routing if I connect to the secondary by name?
It works until the roles change, at which point your reporting workload is quietly running on the primary. Routing keeps the intent with the connection instead of with the server name, and it needs a listener as well as the routing configuration.
Will reads on the secondary be perfectly current?
No. A secondary applies log as it arrives, so readers see data slightly behind the primary and further behind when redo is queued. Check the redo queue if freshness matters.
Does this always mean I have to buy something?
No. Most cases are a replica setting or an incomplete routing list, and those cost nothing. The edition only becomes the answer when the configuration is right and the feature is not available to you.
I see 35262 in the error log. Should I be worried?
No. Its published text says it is informational only and that no user action is required: the database is being started by the availability group rather than by normal startup. It appears routinely.
Can I take backups on a readable secondary instead?
On a full availability group, yes, and it is a common reason to make one readable. A basic availability group is documented as supporting neither read access nor backups on the secondary.
