# SQL Server Integration Reference Guide
{% hint style="info" %}
**Immuta policies will not be automatically enforced in SQL Server**
While you can author and apply subscription and data policies on SQL Server data sources within Immuta, these policies will not be enforced natively in the SQL Server platform. You can use [Immuta webhooks](https://documentation.immuta.com/saas/developer-guides/api-intro/immuta-v1-api/configure-your-instance-of-immuta/webhooks#webhook-overview) to be notified about changes to user access and make appropriate access updates in SQL Server using your own process.
To use this integration, contact your Immuta representative.
{% endhint %}
The SQL Server integration allows you to register data from SQL Server in Immuta. Immuta supports SQL Server deployed through Azure, through Amazon RDS, or self-hosted. See the [Register a SQL Server Connection page](https://documentation.immuta.com/saas/configuration/integrations/register-a-sql-server-connection#requirements) for a list of supported versions.
## What does Immuta do in my environment?
### Registering a connection
SQL Server is configured and data is registered through [connections](https://documentation.immuta.com/saas/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/connections-overview), an Immuta feature that allows you to register your data objects through a single connection to make data registration more scalable for your organization. Instead of registering schema and databases individually, you can register them all at once and allow Immuta to monitor your data platform for changes so that data sources are added and removed automatically to reflect the state of data in your data platform.
When the [connection is registered](https://documentation.immuta.com/saas/configuration/integrations/oracle/register-an-oracle-connection), Immuta ingests and stores connection metadata in the Immuta metadata database. In the example below, the Immuta application administrator connects the database that contains `marketing-data`, `research-data`, and `cs-data` tables. Immuta registers[^1] these tables as data sources and stores the table metadata in the Immuta metadata database.
Immuta presents a hierarchical view of your data that reflects the hierarchy of objects in SQL Server after registration is complete:
* Host
* Database
* Schema
* Table
Beyond making the registration of your data more intuitive, connections provides more control. Instead of performing operations on individual schemas or tables, you can perform operations (such as object sync) at the connection level.
See the [Connections reference guide](https://documentation.immuta.com/saas/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/connections-overview) for details about connections and how to manage them. To configure your SQL Server integration and register data, see the [Register a SQL Server connection guide](https://documentation.immuta.com/saas/configuration/integrations/sql-server/register-a-sql-server-connection).
### Required SQL Server privileges
The privileges that the SQL Server integration requires align to the least privilege security principle. The table below describes each privilege required by the [setup user](#user-content-fn-2)[^2] and the [`IMMUTA_SYSTEM_ACCOUNT`](#user-content-fn-3)[^3] user.
| SQL Server privilege | User requiring the privilege | Explanation |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
| Setup user | This privilege allows the user registering the connection to create the Immuta database and the Immuta system account so that Immuta can register and manage the connection. |
| `ALTER ANY DATABASE` or the `VIEW ANY DATABASE` server-level permission, or `CREATE DATABASE` permission in the `master` database | Immuta system account | This privilege provides access to all the SQL Server system tables necessary to register the connection and maintain state between the SQL Server database and Immuta. |
### Maintaining state with SQL Server
User actions spur processes in the integration so that Immuta data remains synchronous with the data in SQL Server.
Immuta will **create a data source** by registering data source metadata and storing that metadata in the Immuta metadata database when an object is found in SQL Server.
## Supported object types
While you can author and apply subscription and data policies on SQL Server data sources in Immuta, these policies will not be enforced natively in the SQL Server platform. Any GRANTs or data policies must be manually created in SQL Server.
| Object type | Subscription policy support | Data policy support | Request app support |
| ----------- | --------------------------- | ------------------- | -------------------- |
| Table | :x: | :x: | :white\_check\_mark: |
| View | :x: | :x: | :white\_check\_mark: |
## Security and compliance
### Authentication methods
The SQL Server integration supports the following authentication methods to register a connection. The credentials provided must be for an account with the permissions listed in the [Register a SQL Server connection guide](https://documentation.immuta.com/saas/configuration/integrations/sql-server/register-a-sql-server-connection):
* **Username and password**
* **Azure AD token**
## Limitations and known issues
The following Immuta features are unsupported:
* Automatic subscription and data policy enforcement in SQL Server. Any GRANTs or data policies must be manually created in SQL Server.
* Query audit
* Data objects deleted in the native platform will not have their corresponding Immuta data objects automatically deleted. Delete the objects manually when necessary.
* Integrated Security is not supported
[^1]: See the [Connections reference guide](https://documentation.immuta.com/saas/configuration/data-and-integrations/registering-a-connection/reference-guides/connections-overview#object-sync) for more details about how data objects are synced with Immuta so that the objects in SQL Server stay synchronous with the registered objects in Immuta.
[^2]: The SQL Server user registering the connection.
[^3]: This user account is used by Immuta to manage the integration once it has been set up.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://documentation.immuta.com/saas/configuration/integrations/sql-server/sql-server-connection-reference-guide.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)