Microsoft Azure SQL Database

Microsoft Azure SQL Database is a fully managed, relational database-as-a-service (PaaS) offering within the Microsoft Azure cloud platform. It's built on the latest stable version of the SQL Server engine, providing a highly scalable, secure, and intelligent database for modern cloud applications.

In Microsoft Azure

Accessing an Azure SQL Database using Token Authentication

1.1 Log in to Microsoft Azure

1. Open your web browser.
2. Navigate to: https://portal.azure.comhttps://portal.azure.com
3. Sign in with your account credentials.

1.2 Find the App Registrations Service

1. In the main search bar at the top of the Azure Portal, type: App Registrations
2. Click on App Registrations from the results.

1.3 Create an App in App Registrations

1. Click + New registration.
2. Fill in the registration form:

Registration Details:

• Name: Example: RelyanceScan
• Supported account types: Select: “Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)”
• Redirect URI:
  • Platform: Web
  • URL:

https://root.relyance.ai/api/oauth2

1.4 Get Your App Credentials

From the app registration Overview page, copy and save:

• Application (client) ID
• Directory (tenant) ID (This is the “home” tenant where your app is registered)

Create a Client Secret:

1. Click Add a certificate or secret
2. Click + New client secret
3. Add a description
4. Click Add
5. Immediately copy the Value ⚠️ This value will be hidden permanently after leaving the page.

✅ This provides:

• client_id
• client_secret
• tenant_id

1.5 Assign Subscription Permissions

1.5.1 Navigate to Subscriptions

1. In the Azure Portal, search for Subscriptions
2. Click on the subscription you want the app to access
3. Verify that databases and SQL servers exist in the resources

1.5.2 Assign IAM Role

1. Go to Access control (IAM)

2. Click + Add→ Add role assignment

3. Select role: Reader

4. Allows viewing resources without modification

5. Go to Members tab

6. Search and select your app’s name

7. Click Review + assign

1.6 Associate the App Registration with the SQL Server

A. Set the Microsoft Entra ID Admin

This is required for Entra ID-based authentication.

1. Navigate to your SQL Server resource (not the database)
2. In the left menu, go to Settings → Microsoft Entra ID
3. Click Set admin
4. Select a user or Entra ID group (group is best practice)
5. Click Select
6. Click Save

B. Update the Network Firewall

To allow secure access:

1. On the SQL Server page, go to: Security → Networking
2. Under Firewall rules: Click Add your current client IPv4 address This auto-adds your current public IP
3. Add Relyance AI IP Addresses: Open the Relyance AI IP Allow-List page Add each IP as a firewall rule
4. Click Save

C. Assign an IAM Role to the App (Server-Level Access)

This allows the app to view Azure resource metadata (not database data).

1. On the SQL Server page, go to Access control (IAM)

2. Click + Add → Add role assignment

3. Select role: Reader

4. Members tab:

   1. Assign access to: User, group, or service principal
   2. Click + Select members
   3. Search and select your app

5. Click Review + assign

1.7 Create a Database User for the Application

This grants data access inside the database.

1.7.1 Connect to Database

Connect using an Entra ID account that belongs to the admin group created in step 1.6.A

1.7.2 Run the T-SQL Commands

CREATE USER [your-app-name] FROM EXTERNAL PROVIDER;

ALTER ROLE db_datareader ADD MEMBER [your-app-name];

In Relyance AI Application

1. Login to your Relyance AI account.
2. Navigate to the Settings (bottom-left corner).
3. Select Integrations.
4. Search and locate the Microsoft Azure SQL Database integration card and click on it.
5. Click on the Add Connection button on the top right.
6. Provide a meaningful name for the integration and click on the Add button.
7. In the Overview section, review the Scope and Permission, and Endpoint details and click on Continue. For more details, see Integration Features.
8. In the Connection section, provide the appropriate values and click on Continue.
   • Connection Name: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by Discovery Source across the Inventory, Visual Maps, Assets, and Data Flow Analysis pages.
   • Rescan Frequency: This property allows you to configure how often Relyance executes scans against this Vendor connection.
   • Business Atlas Associations (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the Select Associations dropdown — the wizard will not advance past this step without one. For more details, see Business Atlas. Business Atlas
9. In the Authentication section, choose Custom (the only method Azure SQL Database offers), provide the following retrieved from the In Microsoft Azure section, and click Authenticate.

   1. Tenant ID

   2. Client ID

   3. Client Secret

   4. Config Options (optional) — which databases to scan. Deny wins over allow, and the pattern is database.table:

      {
        "allow_list": [],
        "deny_list": ["database_name.*"]
      }

10. Review the configuration summary from the Completion section and click on Finish.
11. Confirm the integration Status reflects Connected.

Verify the connection is really working

This integration authenticates as an Entra ID (Azure AD) application — Tenant ID, Client ID and Client Secret — and then connects to the database as that application. Two layers, and the second is the one that gets missed.

1. Authentication succeeds and the scan finds no tables. The app registration existing is not the same as the database knowing about it. The application needs a database user created for it and read rights granted:

   CREATE USER [<app-registration-name>] FROM EXTERNAL PROVIDER;
   ALTER ROLE db_datareader ADD MEMBER [<app-registration-name>];

   Run this in each database you want scanned — master is not enough.

2. A timeout rather than a permission error is the server firewall. Azure SQL denies public access by default, so the logical server's Networking panel must admit the Relyance egress IPs for your tenant's region. Add every address listed there, not just one: outbound traffic can come from any of them, so a partial allow-list produces scans that sometimes work.

3. A connection that worked and then stopped is usually the client secret expiring. Entra ID secrets carry an expiry date — record it in the connection's Credentials expiry field and Relyance will remind you before it lapses.

4. Fewer databases than expected. Config Options is the scope; left empty every database the application can reach is in scope.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "azure_sql_db" {
  vendor = "azure_sql_db"
  name   = "<your connection name>"

  auth = {
    method = "client-credentials"
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      TENANT_ID = var.azure_sql_db_tenant_id
      client_id = var.azure_sql_db_client_id
      client_secret = var.azure_sql_db_client_secret
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}