> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft SQL Server accounts

> Give people and agents access to a Microsoft SQL Server database without sharing its credentials.

A Microsoft SQL Server [account](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md) stores the credentials for one SQL Server login or Windows user. Members connect to the database through the Infisical CLI, and Infisical records every query they run.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A [gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the database
* A Microsoft SQL Server [account template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md)

## Create the account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** and a Microsoft SQL Server **Account Template**, then select **Next**.

**Step 3**

Enter a **Name** and the connection details:

| Field | Description |
| - | - |
| **Host** | The server's hostname or IP address |
| **Port** | The server's port (defaults to `1433`) |
| **Database** | The database that sessions connect to (defaults to `master`) |
| **SSL Enabled** | Whether to connect over TLS |
| **Reject Unauthorized** | Whether to reject a server certificate that can't be verified (shown when **SSL Enabled** is on) |
| **SSL Certificate** | The CA certificate that signed the server's certificate (shown when **SSL Enabled** is on) |

**Step 4**

Select the **Auth Method** and enter the credentials:

> [tab] SQL Server Authentication
>
> | Field | Description |
> | - | - |
> | **Username** | The SQL Server login |
> | **Password** | The login's password |

> [tab] Windows Authentication (NTLM)
>
> | Field | Description |
> | - | - |
> | **Username** | The Windows user |
> | **Password** | The user's password |
> | **Domain** | The user's Windows domain |

> [tab] Windows Authentication (Kerberos)
>
> | Field | Description |
> | - | - |
> | **Username** | The Windows user |
> | **Password** | The user's password |
> | **Realm** | The Kerberos realm, such as `CORP.EXAMPLE.COM` |
> | **KDC Address** | The address of the key distribution center (optional) |
> | **SPN** | The service principal name of the SQL Server instance, such as `MSSQLSvc/sql01.corp.example.com:1433` |

**Step 5**

Select **Create**.

## Connect

To open a session, follow [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md). Microsoft SQL Server accounts don't support the browser, so use the CLI.

Start the local proxy:

```bash theme={"dark"}
infisical pam access analytics/reporting-db
```

The proxy keeps running in that terminal and prints its port. In a second terminal, connect your SQL Server client, such as `sqlcmd` or Azure Data Studio, to that port:

```bash theme={"dark"}
sqlcmd -S localhost,<port> -d analytics
```

The proxy signs in for you, so the client doesn't need a password.

## Next steps

> [card] [Microsoft SQL Server credential rotation](https://infisical.com/docs/documentation/platform/pam/credential-rotation/mssql.md)
>
> Rotate the passwords of Microsoft SQL Server accounts.

> [card] [Sessions](https://infisical.com/docs/documentation/platform/pam/sessions/overview)
>
> Review and end the connections that people and agents make to your accounts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.