> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/clouds/azure/azure-sql.md).

# Azure SQL

## Requirements

* Within Azure, an Entra App was created and configured as described [here](/connectors/clouds/azure.md)
* Within Teleskope, you have a Teleskope Account with the Admin role

## Permissions

{% stepper %}
{% step %}
**Grant the Teleskope App the following roles:**

Grant the Teleskope app the following role via Access Management (IAM) at the subscription, resource group, or server level:

* Reader

Teleskope discovers SQL servers, SQL managed instances, and SQL Server on Azure VMs (with their network interfaces and public IP addresses) in every subscription the app can read. There is no per-subscription enrollment.

To apply column sensitivity labels with Policy Maker (optional), also grant:

* SQL Security Manager
  {% endstep %}

{% step %}
**Create a Teleskope user on each database**

**Teleskope Database User**

For each SQL instance you would like to scan using Teleskope, you will need to create/provide credentials for a database user, and grant that user permissions.

**Create Teleskope User**

**Create Database User (Without IAM Authentication)**

```sql
CREATE LOGIN teleskope_ro WITH PASSWORD = '****PASSWORD****';
CREATE USER teleskope_ro FOR LOGIN teleskope_ro;
```

**Grant Read Access to Teleskope user**

```sql
GRANT VIEW ANY DATABASE TO teleskope_ro;

DECLARE @sql NVARCHAR(MAX);
SET @sql = '';

-- Generate the dynamic SQL for each database
SELECT @sql += 
    'USE [' + name + ']; 
    GRANT SELECT TO teleskope_ro;
    GRANT VIEW DATABASE STATE TO teleskope_ro;' + CHAR(13)
FROM sys.databases
WHERE state = 0 AND name NOT IN ('tempdb', 'model', 'msdb'); -- Exclude system databases

-- Execute the generated SQL
EXEC sp_executesql @sql;
```

**Grant Write Access to Teleskope user (optional)**

```sql
DECLARE @sql NVARCHAR(MAX);
SET @sql = '';

-- Generate the dynamic SQL for each database
SELECT @sql += 
    'USE [' + name + ']; 
     GRANT UPDATE TO teleskope_ro;
     GRANT DELETE TO teleskope_ro;' + CHAR(13)
FROM sys.databases
WHERE state = 0 AND name NOT IN ('tempdb', 'model', 'msdb'); -- Exclude system databases

-- Execute the generated SQL
EXEC sp_executesql @sql;
```

{% endstep %}
{% endstepper %}