Skip to main content
Microsoft SQL Server discovery scans a set of SQL Server instances, lists the SQL logins on each one, stages them for review, and lets you import them into PAM as MS SQL accounts. You list the instances to scan and the MS SQL accounts to scan with. All scan traffic is tunneled through an Infisical Gateway.
A SQL Server scan connects entirely through the Gateway:
  1. Each target you list is one instance to scan. The gateway resolves hostnames in the target network.
  2. Discovery probes each target on the ports of your credential accounts and skips unreachable targets.
  3. For each reachable target, discovery tries the credential account whose host and port match the target first, then the other accounts in turn.
  4. Discovery stages each login it finds as an MS SQL account scoped to that instance, so a login named sa on two instances becomes two accounts.
The run reports any instance that no credential account can scan, and the rest of the scan still completes.

​
Prerequisites

Before creating a Microsoft SQL Server discovery source, make sure you have:
  • A Gateway (or Gateway pool) with network access to the instances you want to scan
  • One or more MS SQL accounts that use SQL Server authentication, to use as credential accounts (discovery reuses each account’s port, database, and TLS settings)
  • The VIEW ANY DEFINITION or ALTER ANY LOGIN server permission for each credential account’s login, so it can see every login on the instance (members of sysadmin and securityadmin already have it)
  • The Product Admin role on your PAM project

​
Step 1: Create a source

1
Go to Privileged Access Manager > Discovery and select Add Source.
2
Select Microsoft SQL Server, then select Next.
3
Configure the source:
4
Select Add Source. The source appears in the Discovery Sources table.
Discovery only stages enabled SQL logins, and skips Windows logins and SQL Server’s internal logins.

​
Step 2: Run a scan

To start a scan manually, select Scan Now from the source’s row menu or its detail panel. Scans run in the background, one at a time per source, and sources on a Daily or Weekly schedule also scan automatically.

​
Step 3: Import accounts

1
In the Discovery Sources table, select the source to open its detail panel.
2
From the source’s Staged Accounts tab, select the accounts you want and select Import Accounts.
3
Choose a Destination Folder and a Microsoft SQL Server Template, then select Import.
Imported accounts don’t include passwords, because discovery doesn’t read passwords from SQL Server. Open each imported account and add the password for its login before you use it to connect.

​
Next steps

Discovery overview

Understand staging, importing, and schedules.

MS SQL accounts

Learn about the account type used to authenticate scans.