Connect Azure SQL To Mini DBA

Use the Azure SQL connection workflow to monitor Azure SQL logical servers and Azure SQL databases. Azure SQL permissions are granted in the master database for server-level diagnostics and in each monitored database for database-level monitoring.

Add Server Fields

In Servers, select Add Server and choose Azure SQL.

The Mini DBA Engine must be able to reach Azure SQL over the configured network path and firewall rules.

What Mini DBA Monitors After Connection

With the correct Azure SQL permissions, Mini DBA can monitor:

• Azure SQL logical server database inventory.
• Azure SQL Database service tier, compute tier, storage, and configuration.
• Active sessions, blocking, blocked sessions, idle connections, waits, locks, and deadlocks.
• Query Store, expensive queries, profiler data, tables, indexes, and file information.
• Elastic pool database membership, pool usage, and resource history.
• Azure SQL health checks, alerts, and performance tuning evidence.

Azure SQL has both logical-server and database-level pages. Grant server-level permission in master, then grant database-level permissions inside every monitored database.

Required Azure SQL Permissions

The Azure SQL permissions modal checks:

• VIEW SERVER PERFORMANCE STATE: essential for Azure SQL server-level diagnostics. Grant in master.
• VIEW DATABASE PERFORMANCE STATE: essential for Azure SQL database monitoring. Grant in every monitored database.
• VIEW DEFINITION: essential for schema objects and database diagram information. Grant in every monitored database.
• ALTER ANY DATABASE EVENT SESSION: optional, enables Extended Events profiler and fast deadlock detection. Grant in every monitored database.
• KILL DATABASE CONNECTION: optional, allows killing sessions from the console. Grant in every monitored database.

SQL Example: SQL Authentication Login

Run the first block in master. Change the login name and password first.

-- Run in master
IF NOT EXISTS (SELECT 1 FROM sys.sql_logins WHERE name = N'minidba_monitor')
    CREATE LOGIN [minidba_monitor] WITH PASSWORD = 'UseASecretPasswordHere';

IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = N'minidba_monitor')
    CREATE USER [minidba_monitor] FROM LOGIN [minidba_monitor];

ALTER SERVER ROLE ##MS_ServerPerformanceStateReader## ADD MEMBER [minidba_monitor];

Run this block in every monitored Azure SQL database:

-- Run in each monitored database
IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = N'minidba_monitor')
    CREATE USER [minidba_monitor] FROM LOGIN [minidba_monitor];

GRANT VIEW DATABASE PERFORMANCE STATE TO [minidba_monitor];
GRANT VIEW DEFINITION TO [minidba_monitor];
GRANT ALTER ANY DATABASE EVENT SESSION TO [minidba_monitor];
GRANT KILL DATABASE CONNECTION TO [minidba_monitor];

Microsoft Entra Users

For Microsoft Entra authentication, create the matching contained database user from the external provider instead of creating a SQL login:

CREATE USER [minidba-monitor@yourdomain.com] FROM EXTERNAL PROVIDER;

GRANT VIEW DATABASE PERFORMANCE STATE TO [minidba-monitor@yourdomain.com];
GRANT VIEW DEFINITION TO [minidba-monitor@yourdomain.com];
GRANT ALTER ANY DATABASE EVENT SESSION TO [minidba-monitor@yourdomain.com];
GRANT KILL DATABASE CONNECTION TO [minidba-monitor@yourdomain.com];

Use the equivalent contained user for service principals or managed identities in environments that support them.

Verify Permissions In Mini DBA

Open the Azure SQL server or database from the navigation tree and use the Azure SQL Connectivity Permissions modal. When opened at logical server level, it shows server-level permission. When opened at database level, it shows the database permissions for that database.

Use the modal when:

• A database appears but activity, waits, or query pages are incomplete.
• Query Store, profiler, locks, or deadlocks are missing.
• A new database is added to an existing logical server.
• A Microsoft Entra identity or service principal has been changed.

Host OS Login And Metrics

Azure SQL is a platform service, so Mini DBA does not use direct host OS login for Azure SQL databases. Use Azure SQL database metrics, Azure SQL wait/query data, elastic pool metrics, and Cloud Provider Settings where cloud API access is required.

Azure SQL Connection Troubleshooting

• If login fails, confirm Azure SQL firewall rules allow the Mini DBA Engine host.
• If Microsoft Entra authentication fails, confirm the selected authentication mode, tenant, identity, and database user mapping.
• If server-level diagnostics are missing, grant ##MS_ServerPerformanceStateReader## membership in master.
• If database-level pages are empty, create the database user and grant VIEW DATABASE PERFORMANCE STATE in that database.
• If schema or table data is missing, grant VIEW DEFINITION.
• If profiler or deadlock capture is missing, grant ALTER ANY DATABASE EVENT SESSION.
• Right-click the Azure SQL monitored server node in the tree where Connectivity Log is available and open Connectivity Log for Azure SQL firewall, authentication, timeout, TLS, and data-access errors captured by the engine.

Azure SQL Monitoring Permissions FAQ

Do I need to grant permissions in every database?

Yes for database-level monitoring. Azure SQL database permissions are scoped to each database, so create or map the user and grant permissions in every database Mini DBA should monitor.

Is direct OS login available for Azure SQL?

No. Azure SQL is a platform service. Use Azure SQL metrics, Query Store, waits, locks, and elastic pool data instead of direct host OS login.

Can I use Microsoft Entra authentication?

Yes. Use the supported Azure SQL authentication mode in the Add Server panel, then create the matching contained database user and grant the required database permissions.

Related Pages

• Azure SQL monitoring
• Azure SQL elastic pools
• Azure SQL permissions
• Connect database servers
• Troubleshoot database connectivity
• Connectivity Log