diff --git a/internal/services/mssqlmanagedinstance/mssql_managed_instance_security_alert_policy_resource.go b/internal/services/mssqlmanagedinstance/mssql_managed_instance_security_alert_policy_resource.go
index 562ad425e108..83f48035c1cb 100644
--- a/internal/services/mssqlmanagedinstance/mssql_managed_instance_security_alert_policy_resource.go
+++ b/internal/services/mssqlmanagedinstance/mssql_managed_instance_security_alert_policy_resource.go
@@ -210,12 +210,24 @@ func resourceMsSqlManagedInstanceSecurityAlertPolicyUpdate(d *pluginsdk.Resource
 		}
 	}
 
-	props.StorageAccountAccessKey = utils.String(d.Get("storage_account_access_key").(string))
+	if d.HasChange("storage_account_access_key") {
+		props.StorageAccountAccessKey = utils.String(d.Get("storage_account_access_key").(string))
+	}
+
+	// StorageAccountAccessKey cannot be passed in if it is empty. The api returns this as empty so we need to nil it before sending it back to the api
+	if props.StorageAccountAccessKey != nil && *props.StorageAccountAccessKey == "" {
+		props.StorageAccountAccessKey = nil
+	}
 
 	if d.HasChange("storage_endpoint") {
 		props.StorageEndpoint = utils.String(d.Get("storage_endpoint").(string))
 	}
 
+	// StorageEndpoint cannot be passed in if it is empty. The api returns this as empty so we need to nil it before sending it back to the api
+	if props.StorageEndpoint != nil && *props.StorageEndpoint == "" {
+		props.StorageEndpoint = nil
+	}
+
 	future, err := client.CreateOrUpdate(ctx, resourceGroupName, instanceName, existing)
 	if err != nil {
 		return fmt.Errorf("updating managed instance security alert policy: %v", err)