Skip to main content
Microsoft SQL Server discovery finds the SQL logins on your SQL Server instances, so you can import them into PAM as Microsoft SQL Server accounts. For how discovery works across every source type, see Discovery. You give the source a list of instances and one or more Microsoft SQL Server accounts to sign in with. Infisical connects to each instance through a Gateway.
  1. Infisical checks that each instance is reachable on the ports of the source’s Microsoft SQL Server accounts, and skips the instances it can’t reach
  2. For each instance, Infisical first tries the account whose host and port match the instance, then tries the other accounts until one signs in
  3. Infisical lists the enabled SQL logins on the instance, and stages each one as a Microsoft SQL Server account for that instance
If two instances each have a login named sa, Infisical stages two separate accounts. If no account can sign in to an instance, the scan reports the instance and continues with the others.

​
Prerequisites

  • A Gateway that can reach the instances you want to scan
  • One or more Microsoft SQL Server accounts that use SQL Server authentication, to sign in to the instances with
  • The VIEW ANY DEFINITION or ALTER ANY LOGIN server permission for those accounts’ logins, so the scan can see every login (members of the sysadmin and securityadmin roles already have it)
  • The Product Admin role in PAM
  • The Operator or Admin role on those Microsoft SQL Server accounts, because the scan sends their passwords to every instance
Infisical sends the Microsoft SQL Server account’s password to every instance that the source scans, so only list instances you trust.

​
Step 1: Create a source

1
Go to Privileged Access Management > Discovery and select Add Source.
2
Select Microsoft SQL Server, then select Next.
3
Configure the source:Infisical connects to each instance with the port, database, and TLS settings of the Microsoft SQL Server account it signs in with.
4
Select Add Source.

​
Step 2: Run a scan

On the Discovery Sources table, select the options menu on the source’s row, then select Scan Now. A source can run one scan at a time. The scan stages only enabled SQL logins. It skips Windows logins and SQL Server’s internal logins.

​
Step 3: Import accounts

1
On the Discovery Sources table, select the source.
2
On the Staged Accounts tab, select the accounts you want, then select Import Accounts.
3
Select a Destination Folder and a Microsoft SQL Server Template.
4
To have Infisical set a new password on each login during the import, turn on Rotate account passwords on import. Then pick the Microsoft SQL Server Rotation Account, which is the rotation account that Infisical signs in as to change the passwords. By default, the field is set to one of the source’s credential accounts.A rotation account can only change passwords on its own instance (the same host and port), so Infisical imports logins from other instances without a password.
Rotation changes each login’s password on its instance, so anything that signs in with the old password stops working.
5
Select Import.
6
Go to Privileged Access Management > Accounts. The scan doesn’t read passwords, so each imported account that Infisical didn’t rotate shows Unavailable until you set its password. For each of those accounts, open the options menu on its row, select Configure, and enter the password for its login on the Configuration tab.
Your SQL Server logins are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new logins it finds.