--- updatedAt: 2026-05-07T19:41:41.000Z --- # Microsoft SQL Server | Entitle ## What is Microsoft SQL Server? Microsoft SQL Server (MS SQL) is a relational database management system (RDBMS). It is designed to help organizations store, retrieve, and manage data efficiently in a structured format. ## How is this integration useful? Integrating Microsoft SQL Server with Entitle automates database access control, ensuring users have the right permissions for queries, reporting, and management tasks. With this integration, Entitle can manage the following resource types in MS SQL: * **Server** (multiple roles can be assigned) – all the roles in `server_principals` and custom roles created for the server: * sysadmin * serveradmin * securityadmin * processadmin * setupadmin * bulkadmin * diskadmin * dbcreator * Server custom roles * **Database** (multiple roles can be assigned) – all the roles in `database_principals` and custom roles created for the database: * db\_owner * db\_securityadmin * db\_accessadmin * db\_backupoperator * db\_ddladmin * db\_datawriter * db\_datareader * db\_denydatawriter * db\_denydatareader * Database custom roles ## Prerequisites * Have **SQL Server Management Studio** (SSMS) installed. > ℹ️ > > To do so, select **Install SSMS** on the **SQL Server 2019 Evaluation Edition** page. * Have **MS SQL Server** installed. > ℹ️ > > * Entitle currently supports versions 2017 and 2019 only. > * Entitle recommends using an on-premises version of [**MS SQL 2019**](https://www.microsoft.com/en-us/evalcenter/evaluate-sql-server-2019) on EC2 Amazon and to download the instance on c3.large for installation. > * The Security group should allow **RDP connections** (TCP port 3389) and **TCP connections** to the port your SQL server is listening on (the default is 1433). > * The configured server authentication must be **SQL Server and Windows Authentication mode**. SSMS can be used to modify it for a previously installed server: > > 1. In SSMS, navigate to **Properties → Server properties**. [block:image]{"images":[{"image":["https://files.readme.io/7eec2c3d949318c5470b3bf6ce70e0c2735385034d688dcd6a610661094e4d6d-image.png",null,""],"align":"center","sizing":"300px","border":true}]}[/block] > 2. Click **Security**. Under **Server authentication**, select **SQL Server and Windows Authentication mode > OK**. [block:image]{"images":[{"image":["https://files.readme.io/8ef8edef72861f477375a904f1a3aab93db1f2e1ea5d5ba114095e5d909faa03-image.png",null,""],"align":"center","sizing":"450px","border":true}]}[/block] > 3. Restart the server. * Must have an **admin** account in Entitle. * Access to your MS SQL **user, password, server, database,** and **version**. > 🚧 Important information > > **User provisioning is not supported** > > * MS SQL does not support new users’ provisioning, it can only change permissions. The only supported actor types are the following: > * **Database principle** > * SQL user > * **Server principle** > * SQL login > * Windows login > * See the [**MS SQL account mapping**](#ms-sql-account-mapping) section of this guide to map MS SQL users to Entitle. > ℹ️ > > Should you need to allowlist this integration, these are the IP addresses from which Entitle's service reaches the integration: > > * Entitle EU (Cloud deployment) > * 34.243.199.171 > * 54.216.133.226 > * Entitle US (Pathfinder deployment) > * 52.45.229.219 > * 54.88.235.213 > * 3.224.15.134 > * Entitle CA (Pathfinder deployment) > * 35.182.218.208 > * 15.156.179.153 ## Create a new login for Entitle using SSMS > ℹ️ > > Entitle requires creating an admin account that is not a security administrator (`sa`), as this type is exposed to risks. 1. Connect to your new server address. Open the SSMS program and log in as an admin user. [block:image] { "images": [ { "image": [ "https://files.readme.io/6acfd0bc86d02c0d132f9a9abd7c7cbf4bdd30448bdd4e85e86a8c19113f098b-image.png", null, "" ], "align": "center", "sizing": "350px", "border": true } ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/78b71c40c0402ef9802235a8d0fb6abd980b9ea779cf6fd66f43d5ce1018625a-image.png", null, "" ], "align": "center", "sizing": "350px", "border": true } ] } [/block] 2. In SSMS, from the left navigation menu, expand the **Security** folder. 3. In the expanded **Security** folder, right-click the **Logins** sub-folder. 4. Click **New Login**. [block:image]{"images":[{"image":["https://files.readme.io/3511cf93d33421d43c74880c4b83a79becd5cfd5b2da375a1400436c7dea08fc-image.png",null,""],"align":"center","sizing":"300px","border":true}]}[/block] 5. Disable the `Enforce password expiration` option, and insert a password. [block:image]{"images":[{"image":["https://files.readme.io/1bea772680f96d5bc6513949fd48b626be4fd9c1757441ed5d75dd0df2b3ed72-image.png",null,""],"align":"center","sizing":"400px","border":true}]}[/block] ## Add sysadmin role to your Entitle user > ℹ️ > > The Entitle user must have the `sysadmin` role to manage fixed roles, including granting or revoking them from those users. > > If you need to grant access to a user without allowing sysadmin, see [Least-privilege operating mode](#least-privilege-operating-mode). 1. From the left navigation menu, go to the **Server Roles** tab. [block:image]{"images":[{"image":["https://files.readme.io/45e258be82249089b3463043ad02709ea0ffce6fc1a0f0a79e1936c94cc73d36-image.png",null,""],"align":"center","sizing":"450px","border":true}]}[/block] 2. To add a member to a fixed server role, you must be a member of that fixed server role or the `sysadmin` fixed server role. Click **OK** when done. ### Least-privilege operating mode > ℹ️ > > Entitle supports a least-privilege operating mode for Microsoft SQL Server. > > Due to limitations in SQL Server’s permission model, this mode still requires elevated server permissions, but does not require sysadmin. When using least-privilege operating mode, the Entitle service account must be granted the following permissions: * ALTER ANY LOGIN * ALTER ANY SERVER ROLE * CONNECT ANY DATABASE * CONNECT SQL * CONTROL SERVER * VIEW ANY DATABASE * VIEW ANY DEFINITION * VIEW SERVER STATE #### Custom roles requirement Least-privilege operating mode requires the use of custom database roles: * Custom roles must be created in the managed databases. * Required permissions must be granted to those custom roles. * Entitle assigns users to these custom roles as part of access provisioning. In least-privilege operating mode, fixed server roles cannot be altered. ## Verify your Firewall configuration 1. It is recommended that you verify your credentials and Firewall configuration locally before creating the integration in Entitle. > ℹ️ > > See [**How to configure remote access and connect to a remote SQL Server instance with ApexSQL tools**](https://knowledgebase.apexsql.com/configure-remote-access-connect-remote-sql-server-instance-apexsql-tools/). > > * In the **Configure a Windows Firewall for Database Engine Access** section of the abovementioned guide > **step 5** (Profile window), make sure to **tick all three checkboxes** and not just Domain: [block:image]{"images":[{"image":["https://files.readme.io/4c8a979580580ad67c45ad81b1045d2608367e354fea959a1d95131284e51322-image.png",null,""],"align":"center","sizing":"400px","border":true}]}[/block] 2. Download SSMS to your computer and attempt to log in with your Entitle user credentials on your MS SQL Server. If successful, you have verified that the user has been successfully created and the network access is correctly configured. ## Create the MS SQL integration in Entitle 1. Log in to Entitle and go to the **Integrations** page. 2. Click **Add Integration**. 3. In the **Application** field, enter **Microsoft SQL Server**. 4. If you want to be able to create ephemeral accounts, check **Allow creating accounts**. This does not allow you to create permanent accounts. 5. In the **Save on** dropdown, select **Cloud** or your hosted agent. 6. In the **Connection** field: * `version:` Insert the **version** of your server. * `user:` Insert the **user** you created in MS SQL for Entitle. * `password:` Insert the **password** of the user you created in MS SQL for Entitle. * `server:` Insert your MS SQL **server**. It can be either the fully qualified domain name or the IP address. * `database:` Insert the names of your selected **database**. > ✅ Example connection JSON > > ```json > { > "version": "2019" or "2017", > "user": "", > "password": "", > "server": "", > "database": "" > } > ``` 7. Click **Save**.\ The Entitle integration with MS SQL saves ## MS SQL account mapping 1. For end-users to be able to submit new access requests to MS SQL through Entitle, **an admin must manually map the MS SQL Server accounts to their specific Entitle users’ email addresses:** 1. Log in to Entitle and go to the **Org Settings** screen. 2. Scroll down to the **System integrations** section. 3. Click **+ Add**. 4. Select **Microsoft SQL** and choose the accounts you wish to associate with the integration. 5. Click **Add Integration**. [block:image]{"images":[{"image":["https://files.readme.io/60fee406e656a3177612ab723406a1e7a1344e571a09be9187e69e4d6d4ebf53-image.png",null,""],"align":"center","sizing":"300px","border":true}]}[/block] If MS SQL Server accounts are not mapped, an error occurs when attempting to request access. [block:image] { "images": [ { "image": [ "https://files.readme.io/3202b8b9b241cea3c4d661fd37de1415d17d5bb0fd5de6797266b77bc76f8999-image.png", null, "" ], "align": "center", "sizing": "300px", "border": true } ] } [/block] ## Integration troubleshooting > ℹ️ > > Integration sync time varies based on the number of resources, roles, and entitlements in the third-party system. 1. In Entitle, navigate to **Integrations**. 2. Confirm the date/time of the **Last sync** on the integration card. This indicates the last time Entitle pulled all resources, roles, and entitlements from the third-party system. 3. Select the integration and check the **Last sync** indicator next to **Resources**. This indicates the last time Entitle pulled the resources from the third-party system. 4. Expand **Audit logs** to review integration activity and errors. ## Create an ephemeral account 1. In Entitle, go to the **Requests** page and click **New request**. [block:image] { "images": [ { "image": [ "https://files.readme.io/cd0e6afde0f7a863a7188a799f322c0afed48ad2c3c0dfa015796b6b5f0fe741-requests-new-request-button.png", null, "" ], "align": "center", "sizing": "80% ", "border": true } ] } [/block] 2. Using the dropdown at the top right, you can make the request for yourself or on behalf of another user. 3. Click on your Microsoft SQL Server application. Choose the resources and the roles you would like to request access to. Then click **Next**. [block:image] { "images": [ { "image": [ "https://files.readme.io/fb0998e83bf23c87d38cce7264c7eb2765a031a360fda11c2e2846a9fb1b39a4-requests-new-request.png", null, "" ], "align": "center", "sizing": "80% ", "border": true } ] } [/block] 4. Set the duration for the ephemeral account and click **Next**. [block:image] { "images": [ { "image": [ "https://files.readme.io/d57a0446dd4b266b14653064e199718d7a9da2ef70956f3fcb406f3c06f376fe-requests-duration.png", null, "" ], "align": "center", "sizing": "40% ", "border": true } ] } [/block] 5. Select an account to associate with your request. You are not requesting access to the actual user account; instead, Entitle creates an ephemeral account with the same permissions. This temporary account is prefixed with *entitle* so that any actions you perform are easy to identify, ensuring security and auditability by isolating your activity from the original account. [block:image] { "images": [ { "image": [ "https://files.readme.io/7a7b275548dcac6b51acc22d64766fb73d655078ebaabdc443353e688d5628b5-request-select-account.png", "", "" ], "align": "center", "border": true } ] } [/block] 6. Provide a reason for your request. If a third-party ticketing system is integrated with your Entitle instance, you may link to a ticket. Click **Review Request**. [block:image] { "images": [ { "image": [ "https://files.readme.io/ecaed0a26eb829dc41d94f8069ddd8ec7ab4dfb70661d8bdc5c145ca7507b007-requests-reason.png", null, "" ], "align": "center", "sizing": "50% ", "border": true } ] } [/block] 7. Review your request’s details and adjust if needed. Click **Submit request**. [block:image] { "images": [ { "image": [ "https://files.readme.io/d10189298b3e509bea95a5698af40fb7f76a436f3e8a08e2ea01d42956d8205b-requests-summary.png", null, "" ], "align": "center", "sizing": "80% ", "border": true } ] } [/block] 8. Your request is submitted and is added to the **My pending requests** section. [block:image] { "images": [ { "image": [ "https://files.readme.io/369e09fdb1f0a58c0540fbf4c93c3c716b74fff3e1cdc8896a7ea0fdb35bf2a1-requests-pending.png", null, "" ], "align": "center", "sizing": "80% ", "border": true } ] } [/block] 9. Once approved, you are granted access to the specific role. [block:image] { "images": [ { "image": [ "https://files.readme.io/d97c37faaaa1ac7800b5c8ad736faddbdab325ea6201e91caf73d7ba775d5627-request-approved.png", null, "" ], "align": "center", "sizing": "80% ", "border": true } ] } [/block] 10. Use the ephemeral account to do the needed work. Your actions are logged as *entitle\_\[account\_name]*. 11. When the duration expires, the ephemeral account is deleted and cannot be used again. A new ephemeral account must be created if further temporary access is required.