# Microsoft Azure SQL Database

**Microsoft Azure SQL Database** is a fully managed, relational database-as-a-service (PaaS) offering within the Microsoft Azure cloud platform. It's built on the latest stable version of the SQL Server engine, providing a highly scalable, secure, and intelligent database for modern cloud applications.

## In Microsoft Azure

### Accessing an Azure SQL Database using Token Authentication

#### 1.1 Log in to Microsoft Azure

1. Open your web browser.
2. Navigate to: [https://portal.azure.com](https://portal.azure.com)[https://portal.azure.com](https://portal.azure.com)
3. Sign in with your account credentials.

#### 1.2 Find the App Registrations Service

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/43496031759373.png)
1. In the main search bar at the top of the Azure Portal, type:
**App Registrations**
2. Click on **App Registrations** from the results.

#### 1.3 Create an App in App Registrations

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/43496027195405.png)
![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736131411597.png)
1. Click **+ New registration**.
2. Fill in the registration form:

**Registration Details:**

- **Name:**
Example: `RelyanceScan`
- **Supported account types:**
Select:
*“Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)”*
- **Redirect URI:**
    - Platform: **Web**
    - URL:
```
https://root.relyance.ai/api/oauth2
```

1.4 Get Your App Credentials

From the app registration **Overview** page, copy and save:

- **Application (client) ID**
- **Directory (tenant) ID**
(This is the “home” tenant where your app is registered)

##### Create a Client Secret:

1. Click **Add a certificate or secret**
2. Click **+ New client secret**
3. Add a description
4. Click **Add**
5. Immediately copy the **Value**
⚠️ This value will be hidden permanently after leaving the page.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/43495838467341.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/43495760810637.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/43495838470925.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/43495838471437.png)

✅ This provides:

- `client_id`
- `client_secret`
- `tenant_id`

#### 1.5 Assign Subscription Permissions

##### 1.5.1 Navigate to Subscriptions

1. In the Azure Portal, search for **Subscriptions**
2. Click on the subscription you want the app to access
3. Verify that databases and SQL servers exist in the resources

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736076669965.png)

##### 1.5.2 Assign IAM Role

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736076671245.png)
1. Go to **Access control (IAM)**
2. Click **+ Add**→ **Add role assignment**

3. Select role: **Reader**
4. Allows viewing resources without modification
5. Go to **Members** tab
6. Search and select your app’s name
7. Click **Review + assign**

#### 1.6 Associate the App Registration with the SQL Server

##### A. Set the Microsoft Entra ID Admin

This is required for Entra ID-based authentication.

1. Navigate to your **SQL Server resource** (not the database)
2. In the left menu, go to **Settings → Microsoft Entra ID**
3. Click **Set admin**
4. Select a **user or Entra ID group** (group is best practice)
5. Click **Select**
6. Click **Save**

##### B. Update the Network Firewall

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736076672269.png)
To allow secure access:

1. On the SQL Server page, go to:
**Security → Networking**
2. Under **Firewall rules**:
Click **Add your current client IPv4 address**
This auto-adds your current public IP
3. Add **Relyance AI IP Addresses**:
Open the *Relyance AI IP Allow-List page*
Add each IP as a firewall rule
4. Click **Save**

##### C. Assign an IAM Role to the App (Server-Level Access)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736131418765.png)
![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736076674445.png)
This allows the app to view Azure resource metadata (not database data).

1. On the SQL Server page, go to **Access control (IAM)**
2. Click **+ Add → Add role assignment**

3. Select role: **Reader**
4. Members tab:
    1. Assign access to: **User, group, or service principal**
    2. Click **+ Select members**
    3. Search and select your app

5. Click **Review + assign**

#### 1.7 Create a Database User for the Application

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736076678285.png)
This grants **data access inside the database**.

#### 1.7.1 Connect to Database

Connect using an Entra ID account that belongs to the admin group created in step **1.6.A**

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736131421965.png)

#### 1.7.2 Run the T-SQL Commands

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736131425293.png)

CREATE USER [your-app-name] FROM EXTERNAL PROVIDER;

ALTER ROLE db_datareader ADD MEMBER [your-app-name];

#### **In Relyance AI Application**

1. Login to your Relyance AI account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Microsoft Azure SQL Database** integration card and click on it.
5. Click on the **Add Connection** button on the top right.
6. Provide a meaningful name for the integration and click on the **Add** button.
7. In the **Overview** section, review the **Scope and Permission**, and **Endpoint** details and click on **Continue**. For more details, see [Integration Features](/docs/introduction-to-relyance-ai/integration-features/).
8. In the **Connection** section, provide the appropriate values and click on **Continue**.
    - **Connection Name**: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by Discovery Source across the Inventory, Visual Maps, Assets, and Data Flow Analysis pages.
    - **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    - **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/). [Business Atlas](/docs/other-settings/business-atlas-overview/)
9. In the **Authentication** section, choose **Custom** (the only method Azure SQL Database offers), provide the following retrieved from the **In Microsoft Azure** section, and click **Authenticate**.
    1. **Tenant ID**
    2. **Client ID**
    3. **Client Secret**
    4. **Config Options** (optional) — which databases to scan. Deny wins over allow, and the pattern is `database.table`:

       ```json
       {
         "allow_list": [],
         "deny_list": ["database_name.*"]
       }
       ```
10. Review the configuration summary from the **Completion** section and click on **Finish**.
11. Confirm the integration **Status** reflects **Connected**.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736131426061.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/37016725083789.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/40736076682765.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/37016720237837/37016720236941.png)

### Verify the connection is really working

This integration authenticates as an Entra ID (Azure AD) application — **Tenant
ID**, **Client ID** and **Client Secret** — and then connects to the database as
that application. Two layers, and the second is the one that gets missed.

1. **Authentication succeeds and the scan finds no tables.** The app registration
   existing is not the same as the *database* knowing about it. The application
   needs a database user created for it and read rights granted:

    ```sql
    CREATE USER [<app-registration-name>] FROM EXTERNAL PROVIDER;
    ALTER ROLE db_datareader ADD MEMBER [<app-registration-name>];
    ```

    Run this in each database you want scanned — `master` is not enough.
2. **A timeout rather than a permission error** is the server firewall. Azure SQL
   denies public access by default, so the logical server's **Networking** panel
   must admit the
   [Relyance egress IPs](/docs/integrations/relyance-ai-ip-addresses-for-allow-lists/)
   for your tenant's region. Add every address listed there, not just one: outbound
   traffic can come from any of them, so a partial allow-list produces scans that
   sometimes work.
3. **A connection that worked and then stopped** is usually the client secret
   expiring. Entra ID secrets carry an expiry date — record it in the connection's
   **Credentials expiry** field and Relyance will remind you before it lapses.
4. **Fewer databases than expected.** **Config Options** is the scope; left empty
   every database the application can reach is in scope.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "azure_sql_db" {
  vendor = "azure_sql_db"
  name   = "<your connection name>"

  auth = {
    method = "client-credentials"
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      TENANT_ID = var.azure_sql_db_tenant_id
      client_id = var.azure_sql_db_client_id
      client_secret = var.azure_sql_db_client_secret
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->