> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft SQL Server discovery

> Scan Microsoft SQL Server instances for SQL logins and import them into PAM.

Microsoft SQL Server discovery finds the SQL logins on your SQL Server instances, so you can import them into PAM as [Microsoft SQL Server accounts](https://infisical.com/docs/documentation/platform/pam/accounts/mssql.md). For how discovery works across every source type, see [Discovery](https://infisical.com/docs/documentation/platform/pam/discovery/overview).

You give the source a list of instances and one or more Microsoft SQL Server accounts to sign in with. Infisical connects to each instance through a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md).

> [accordion] How a scan works
>
> 1. Infisical checks that each instance is reachable on the ports of the source's Microsoft SQL Server accounts, and skips the instances it can't reach
> 2. For each instance, Infisical first tries the account whose host and port match the instance, then tries the other accounts until one signs in
> 3. Infisical lists the enabled SQL logins on the instance, and stages each one as a Microsoft SQL Server account for that instance
>
> If two instances each have a login named `sa`, Infisical stages two separate accounts. If no account can sign in to an instance, the scan reports the instance and continues with the others.

## Prerequisites

* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the instances you want to scan
* One or more [Microsoft SQL Server accounts](https://infisical.com/docs/documentation/platform/pam/accounts/mssql.md) that use SQL Server authentication, to sign in to the instances with
* The `VIEW ANY DEFINITION` or `ALTER ANY LOGIN` server permission for those accounts' logins, so the scan can see every login (members of the `sysadmin` and `securityadmin` roles already have it)
* The [Product Admin role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#product-membership) in PAM
* The Operator or Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#folder-and-account-memberships) on those Microsoft SQL Server accounts, because the scan sends their passwords to every instance

> [!WARNING]
>
> Infisical sends the Microsoft SQL Server account's password to every instance that the source scans, so only list instances you trust.

## Step 1: Create a source

**Step 1**

Go to **Privileged Access Management** > **Discovery** and select **Add Source**.

**Step 2**

Select **Microsoft SQL Server**, then select **Next**.

**Step 3**

Configure the source:

| Field | Description |
| - | - |
| **Name** | A name for the source, such as `prod-sql-servers` |
| **Credential Accounts** | The Microsoft SQL Server accounts to sign in to the instances with |
| **Gateway** | The Gateway or Gateway pool to connect through |
| **Scan Schedule** | **Manual**, **Daily**, or **Weekly** (see [scan schedules](https://infisical.com/docs/documentation/platform/pam/discovery/overview#scan-schedules)) |
| **Targets** | The IP addresses or hostnames of the instances to scan, one per line or separated by commas (the Gateway resolves hostnames) |

Infisical connects to each instance with the port, database, and TLS settings of the Microsoft SQL Server account it signs in with.

**Step 4**

Select **Add Source**.

## Step 2: Run a scan

On the **Discovery Sources** table, select the options menu on the source's row, then select **Scan Now**. A source can run one scan at a time.

The scan stages only enabled SQL logins. It skips Windows logins and SQL Server's internal logins.

## Step 3: Import accounts

**Step 1**

On the **Discovery Sources** table, select the source.

**Step 2**

On the **Staged Accounts** tab, select the accounts you want, then select **Import Accounts**.

**Step 3**

Select a **Destination Folder** and a **Microsoft SQL Server Template**.

**Step 4**

To have Infisical set a new password on each login during the import, turn on **Rotate account passwords on import**. Then pick the **Microsoft SQL Server Rotation Account**, which is the [rotation account](https://infisical.com/docs/documentation/platform/pam/credential-rotation/overview.md#rotation-accounts) that Infisical signs in as to change the passwords. By default, the field is set to one of the source's credential accounts.

A rotation account can only change passwords on its own instance (the same host and port), so Infisical imports logins from other instances without a password.

> [!WARNING]
>
> Rotation changes each login's password on its instance, so anything that signs in with the old password stops working.

**Step 5**

Select **Import**.

**Step 6**

Go to **Privileged Access Management** > **Accounts**. The scan doesn't read passwords, so each imported account that Infisical didn't rotate shows **Unavailable** until you set its password. For each of those accounts, open the options menu on its row, select **Configure**, and enter the password for its login on the **Configuration** tab.

> [!TIP]
>
> Your SQL Server logins are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new logins it finds.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.