This page covers what’s specific to rotating the password of a Microsoft SQL Server account. To turn on rotation and set a rotation account, see Credential rotation.
Infisical can only rotate accounts that use SQL Server authentication. If an account uses Windows authentication, its password belongs to a Windows or Active Directory account, so Infisical can’t rotate it as a SQL Server account. To rotate that password, add the same user to PAM as a Windows or Windows AD account and rotate it there.
Infisical doesn’t update the SQL Server account when the Windows or Windows AD account rotates. After each rotation, enter the new password on the SQL Server account, or its sessions fail.
Rotation account
The rotation account needs permission to change the target login’s password:
- The account itself: A login can change its own password, so it needs no extra privileges
- A different account: The rotation account needs the
ALTER ANY LOGIN permission
For example, to create a rotation login and a login for it to rotate:
Add both logins to Infisical PAM as Microsoft SQL Server accounts with the same host and port, then select infisical_rotator as the rotation account on the app_login account’s Rotation tab.
How the password is changed
Infisical signs in as the rotation account, using the account’s connection details and SSL settings, and runs:
