Creating Jupyter Notebook in Azure Data Studio. can it automatically create an Azure SQL DB?

Question

Hi there,

working in Azure Data Studio I created a Jupyter Notebook to create a testing script

Later on we noticed that a new SQL Database had been created in the azure Resource group TestNotebookDB. I hadn't created it and no one else had and I assumed that it may have been created automatically when I created the Notebook?

It seemed to be quite an expensive one too so not knowing that it had been added is pretty worrying. Especially when lots of other people are using Azure data Studio and can create their own Notebooks.

Can anyone tell me if this is the case? if it is the case we need to flag this up as a risk.

Answer 1

Must probably that database was created when someone used a Microsoft Learn tutorial like this one to learn to use notebooks.

The best resort to answer who created that database and from what application name? is to enable Azure SQL Auditing, enabling auditing tracks database events and write them to audit log which can be stored into Azure storage account, Log Analytics workspace or Event Hubs.

Leverage the Log Analytics to retrieve and filter the Audit records, the following example is a Kusto Query to get audit data for the created database:

let ServerName = "XXXXXXXXXX"; # Change the Server name to Azure SQL Server name   
AzureDiagnostics  
| where LogicalServerName_s =~ ServerName  
| where Category =~ "SQLSecurityAuditEvents"  
| where statement_s contains "CREATE"  
| project TimeGenerated, event_time_t, LogicalServerName_s, database_name_s, succeeded_s, session_id_d, action_name_s,client_ip_s, session_server_principal_name_s , database_principal_name_s, statement_s, additional_information_s, application_name_s  
| top 1000 by TimeGenerated desc  

Answer 2

I have already deleted the database

Is there any other way I can find out how it was created now its been deleted?

So basically, it wasnt simply auto created from creating a Notebook then which is good news at least

Answer 3

Please visit Azure Activity Log to know when it was created or drqpped.

For future events, please enable Azure SQL Auditing to have more detailed auditing data.