| title | Security Documentation for SQL Server & Azure SQL Database | ||||
|---|---|---|---|---|---|
| description | A reference of security and protection-related content for SQL Server and Azure SQL Database. | ||||
| author | VanMSFT | ||||
| ms.author | vanto | ||||
| ms.date | 06/30/2025 | ||||
| ms.service | sql | ||||
| ms.subservice | security | ||||
| ms.topic | conceptual | ||||
| helpviewer_keywords |
|
||||
| monikerRange | >=aps-pdw-2016 || =azuresqldb-current || =azure-sqldw-latest || >=sql-server-2016 || >=sql-server-linux-2017 || =azuresqldb-mi-current |
[!INCLUDE SQL Server Azure SQL Database Synapse Analytics PDW]
This page provides links to help you locate the information that you need about security and protection in the [!INCLUDE ssDEnoversion] and [!INCLUDE ssazure-sqldb].
Legend
| Feature | Link |
|---|---|
| Who Authenticates? :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Windows Authentication :::image type="icon" source="../performance/media/security-center-both.png"::: [!INCLUDE ssNoVersion] Authentication :::image type="icon" source="../../relational-databases/security/media/security-center-both.png"::: Microsoft Entra ID (formerly Azure Active Directory) |
Who Authenticates? (Windows or [!INCLUDE ssNoVersion]) Choose an authentication mode Connect to Azure SQL with Microsoft Entra authentication |
| Where Authenticated? :::image type="icon" source="../performance/media/security-center-both.png"::: At master database: Logins and Database Users:::image type="icon" source="../performance/media/security-center-both.png"::: At User Database: Contained DB Users |
Authenticate at the master database (Logins and database users)Create a login Managing Databases and Logins in Azure SQL Database Create a database user Authenticate at a user database Make your database portable by using contained databases |
| Using Other Identities :::image type="icon" source="../performance/media/security-center-both.png"::: Credentials :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Execute as Another Login :::image type="icon" source="../performance/media/security-center-both.png"::: Execute as Another Database User |
Credentials (Database Engine) EXECUTE AS EXECUTE AS |
| Feature | Link |
|---|---|
| Granting, Revoking, and Denying Permissions :::image type="icon" source="../performance/media/security-center-both.png"::: Securable Classes :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Granular Server Permissions :::image type="icon" source="../performance/media/security-center-both.png"::: Granular Database Permissions |
Permissions Hierarchy (Database Engine) Permissions (Database Engine) Securables Get started with Database Engine permissions |
| Security by Roles :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Server Level Roles :::image type="icon" source="../performance/media/security-center-both.png"::: Database Level Roles |
Server-level roles Database-level roles |
| Restricting Data Access to Selected Data Elements :::image type="icon" source="../performance/media/security-center-both.png"::: Restrict Data Access With Views/Procedures :::image type="icon" source="../performance/media/security-center-both.png"::: Row-Level Security :::image type="icon" source="../performance/media/security-center-both.png"::: Dynamic Data Masking :::image type="icon" source="../performance/media/security-center-both.png"::: Signed Objects |
Restrict Data Access Using Views and Stored procedures (Database Engine) Row-level security Row-level security Dynamic data masking Dynamic Data Masking (Azure SQL Database) ADD SIGNATURE |
| Feature | Link |
|---|---|
| Encrypting Files :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: BitLocker Encryption (Drive Level) :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: NTFS Encryption (Folder Level) :::image type="icon" source="../performance/media/security-center-both.png"::: Transparent Data Encryption (File Level) :::image type="icon" source="../performance/media/security-center-both.png"::: Backup Encryption (File Level) |
BitLocker (Drive Level) NTFS Encryption (Folder Level) Transparent data encryption (TDE) Backup encryption |
| Encrypting Sources :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Extensible Key Management Module :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Keys Stored in the Azure Key Vault :::image type="icon" source="../performance/media/security-center-both.png"::: Always Encrypted |
Extensible Key Management (EKM) Extensible Key Management Using Azure Key Vault (SQL Server) Always Encrypted |
| Column, Data, & Key Encryption :::image type="icon" source="../performance/media/security-center-both.png"::: Encrypt by Certificate :::image type="icon" source="../performance/media/security-center-both.png"::: Encrypt by Symmetric Key :::image type="icon" source="../performance/media/security-center-both.png"::: Encrypt by Asymmetric Key :::image type="icon" source="../performance/media/security-center-both.png"::: Encrypt by Passphrase |
ENCRYPTBYCERT ENCRYPTBYASYMKEY ENCRYPTBYKEY ENCRYPTBYPASSPHRASE Encrypt a Column of Data |
| Feature | Link |
|---|---|
| Firewall Protection :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Windows Firewall Settings :::image type="icon" source="../../relational-databases/security/media/security-center-sqldb.png"::: Azure Service Firewall Settings :::image type="icon" source="../../relational-databases/security/media/security-center-sqldb.png"::: Database Firewall Settings |
Configure Windows Firewall for Database Engine access sp_set_database_firewall_rule (Azure SQL Database) sp_set_firewall_rule (Azure SQL Database) |
| Encrypting Data in Transit :::image type="icon" source="../performance/media/security-center-both.png"::: Forced TLS/SSL Connections :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Optional SSL Connections |
Configure SQL Server Database Engine for encrypting connections Configure SQL Server Database Engine for encrypting connections, Network security TLS 1.2 support for Microsoft SQL Server |
| Feature | Link |
|---|---|
| Automated Auditing :::image type="icon" source="../../relational-databases/performance/media/security-center-sqlserver.png"::: [!INCLUDE ssNoVersion] Audit (Server and DB Level) :::image type="icon" source="../../relational-databases/security/media/security-center-sqldb.png"::: [!INCLUDE ssSDS] Audit (Database Level) :::image type="icon" source="../../relational-databases/security/media/security-center-sqldb.png"::: Detect threats |
SQL Server Audit (Database Engine) SQL Database Auditing Get started with SQL Database Advanced Threat Protection SQL Database Vulnerability Assessment |
| Custom Audit :::image type="icon" source="../../relational-databases/performance/media/security-center-both.png"::: Triggers |
Custom Audit Implementation: Creating DDL Triggers and DML Triggers |
| Compliance :::image type="icon" source="../../relational-databases/performance/media/security-center-both.png"::: Compliance |
SQL Server: Common Criteria SQL Database: Microsoft Azure Trust Center: Compliance by Feature |
SQL injection is an attack in which malicious code is inserted into strings that are later passed to the [!INCLUDE ssDE] for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because [!INCLUDE ssNoVersion] will execute all syntactically valid queries that it receives. All database systems have some risk of SQL Injection, and many of the vulnerabilities are introduced in the application that is querying the [!INCLUDE ssDE]. You can thwart SQL injection attacks by using stored procedures and parameterized commands, avoiding dynamic SQL, and restricting permissions on all users. For more information, see SQL injection.
Additional links for application programmers:
- Get started with Database Engine permissions
- Securing SQL Server
- Principals (Database Engine)
- SQL Server Certificates and Asymmetric Keys
- SQL Server encryption
- Surface area configuration
- Strong Passwords
- TRUSTWORTHY database property
- What's new in SQL Server 2019
- Protecting Your SQL Server Intellectual Property
[!INCLUDE get-help-security]