Bewerken

Delen via

Security for SQL Server Database Engine and Azure SQL Database

  • Artikel

Applies to: SQL Server Azure SQL Database Azure SQL Managed Instance Azure Synapse Analytics Analytics Platform System (PDW)

This page provides links to help you locate the information that you need about security and protection in the SQL Server Database Engine and Azure SQL Database.

Legend

Screenshot of the legend that explains the feature availability icons.

Authentication: Who are you?

Feature Link
Who Authenticates?

Windows Authentication

SQL Server Authentication

Microsoft Entra ID (formerly Azure Active Directory)		 Who Authenticates? (Windows or SQL Server)

Choose an Authentication Mode

Connect to Azure SQL with Microsoft Entra authentication
Where Authenticated?

At master Database: Logins and DB Users

At User Database: Contained DB Users		 Authenticate at the master database (Logins and database users)

Create a SQL Server Login

Managing Databases and Logins in Azure SQL Database

Create a Database User



Authenticate at a user database

Contained Database Users - Making Your Database Portable
Using Other Identities

Credentials

Execute as Another Login

Execute as Another Database User		 Credentials (Database Engine)

Execute as Another Login

Execute as Another Database User

Authorization: What can you do?

Feature Link
Granting, Revoking, and Denying Permissions

Securable Classes

Granular Server Permissions

Granular Database Permissions		 Permissions Hierarchy (Database Engine)

Permissions

Securables

Getting Started with Database Engine Permissions
Security by Roles

Server Level Roles

Database Level Roles		 Server-Level Roles

Database-Level Roles
Restricting Data Access to Selected Data Elements

Restrict Data Access With Views/Procedures

Row-Level Security

Dynamic Data Masking

Signed Objects		 Restrict Data Access Using Views and Procedures

Row-Level Security (SQL Server)

Row-Level Security (Azure SQL Database)

Dynamic Data Masking (SQL Server)

Dynamic Data Masking (Azure SQL Database)

Signed Objects

Encryption: Storing Secret Data

Feature Link
Encrypting Files

BitLocker Encryption (Drive Level)

NTFS Encryption (Folder Level)

Transparent Data Encryption (File Level)

Backup Encryption (File Level)		 BitLocker (Drive Level)

NTFS Encryption (Folder Level)

Transparent Data Encryption (File Level)

Backup Encryption (File Level)
Encrypting Sources

Extensible Key Management Module

Keys Stored in the Azure Key Vault

Always Encrypted		 Extensible Key Management Module

Keys Stored in the Azure Key Vault

Always Encrypted
Column, Data, & Key Encryption

Encrypt by Certificate

Encrypt by Symmetric Key

Encrypt by Asymmetric Key

Encrypt by Passphrase		 Encrypt by Certificate

Encrypt by Asymmetric Key

Encrypt by Symmetric Key

Encrypt by Passphrase

Encrypt a Column of Data

Connection Security: Restricting and Securing

Feature Link
Firewall Protection

Windows Firewall Settings

Azure Service Firewall Settings

Database Firewall Settings		 Configure a Windows Firewall for Database Engine Access

Azure SQL Database Firewall Settings

Azure Service Firewall Settings
Encrypting Data in Transit

Forced SSL Connections

Optional SSL Connections		 Enable Encrypted Connections to the Database Engine

Enable Encrypted Connections to the Database Engine, Network security

TLS 1.2 support for Microsoft SQL Server

Auditing: Recording Access

Feature Link
Automated Auditing

SQL Server Audit (Server and DB Level)

SQL Database Audit (Database Level)

Detect threats

SQL Server Audit (Database Engine)

SQL Database Auditing

Get started with SQL Database Advanced Threat Protection

SQL Database Vulnerability Assessment
Custom Audit

Triggers		 Custom Audit Implementation: Creating DDL Triggers and DML Triggers
Compliance

Compliance		 SQL Server:
Common Criteria

SQL Database:
Microsoft Azure Trust Center: Compliance by Feature

SQL Injection

SQL injection is an attack in which malicious code is inserted into strings that are later passed to the Database Engine for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives. All database systems have some risk of SQL Injection, and many of the vulnerabilities are introduced in the application that is querying the Database Engine. You can thwart SQL injection attacks by using stored procedures and parameterized commands, avoiding dynamic SQL, and restricting permissions on all users. For more information, see SQL Injection.

Additional links for application programmers:

See Also

Getting Started with Database Engine Permissions
Securing SQL Server
Principals (Database Engine)
SQL Server Certificates and Asymmetric Keys
SQL Server Encryption
Surface Area Configuration
Strong Passwords
TRUSTWORTHY Database Property
Database Engine Features and Tasks
Protecting Your SQL Server Intellectual Property

Get help