Azure SQL Database Setup Guide

IMPORTANT: To use this authentication method, your Azure SQL Database must have Microsoft Entra ID (formerly Azure Active Directory) authentication enabled, and you must be signed in with a user who has the Microsoft Entra admin role on the database.

Additionally, this method is supported only in Hybrid Deployment and requires that both the Hybrid Deployment Agent and the Azure SQL Database reside under the same Microsoft Entra tenant.

• Follow Azure’s guide to configuring Entra ID authentication for Azure SQL to enable Entra ID authentication.

• Follow Azure’s Managed Identity documentation to enable and assign a Managed Identity to the Azure resource where the Fivetran's Hybrid Deployment Agent runs.

To use this method, you need the following:

• A Managed Identity (either User Assigned or System Assigned) configured on the Azure resource (such as a VM) where the Fivetran Hybrid Deployment Agent is installed.
• The Managed Identity’s Client ID (for User Assigned Managed Identity only)

Retrieve the Managed Identity Client ID (User Assigned Managed Identity only)

1. Open the Azure Portal and sign in.

2. In the top search bar, search for 'Managed Identities'.

3. Select the User Assigned Managed Identity you want to use.

4. In the Overview tab, copy the Client ID. You will need to enter this in the Fivetran connection setup form later.

   

Create a user in Azure SQL Database

To allow your Managed Identity (UAMI or SAMI) to access the Azure SQL Database, create a user in the database using the following command. Replace <PRINCIPAL-NAME> with the name of your Managed Identity.

CREATE USER [<PRINCIPAL-NAME>] FROM EXTERNAL PROVIDER;

NOTE: You’ll grant the appropriate database permissions to this Managed Identity user in the Grant user permissions step later.

To use this method, you need the following:

• A Service Principal registered in Microsoft Entra ID
• The Service Principal Client ID (Application ID)
• The Service Principal Client Secret

Register a Service Principal in Microsoft Entra ID

1. Open the Azure Portal and sign in.
2. Navigate to Microsoft Entra ID > App registrations.
3. Click + New registration.
4. Enter a name for the app (for example, Fivetran-SQL-Connector) and click Register.
5. Once registered, go to the app’s Overview tab and copy the Application (client) ID. This is your Service Principal Client ID. You will need to enter this in the Fivetran connection setup form later.

Create a Client Secret

1. In the left-hand menu of your app, go to Certificates & secrets.

2. Under Client secrets, click + New client secret:

3. Enter a description and choose an expiration period.

4. Click Add.

5. Copy the Value of the secret immediately - it is shown only once.

   IMPORTANT: Keep this secret secure and monitor its expiration to avoid disruptions.

   This is your Service Principal Client Secret. You will also need this in the Fivetran connection setup form.

Create a user in Azure SQL Database

To allow your Service Principal to connect to the Azure SQL Database, run the following command. Replace <PRINCIPAL-NAME> with the name of your Service Principal.

CREATE USER [<PRINCIPAL-NAME>] FROM EXTERNAL PROVIDER;

NOTE: You’ll grant the appropriate database permissions to this Service Principal user in the Grant user permissions step later.

To use this method, you need the following:

• A Service Principal registered in Microsoft Entra ID
• The Service Principal Client ID (Application ID)
• A valid client certificate
• The corresponding private key (if stored separately from the certificate).

Register a Service Principal in Microsoft Entra ID

1. Open the Azure Portal and sign in.

2. Navigate to Microsoft Entra ID > App registrations.

3. Click + New registration.

4. Enter a name for the app (for example, Fivetran-SQL-Cert-Auth) and click Register.

5. Once registered, go to the app’s Overview tab and copy the Application (client) ID. This is your Service Principal Client ID. You will need to enter this in the Fivetran connection setup form later.

   

Generate and upload a client certificate

To authenticate using a certificate, your Service Principal must be configured with a valid public certificate.

There are multiple ways to generate a certificate, and you're free to use any method that fits your organization's tooling or security policies. Two commonly used approaches are:

openssl req -x509 -newkey rsa:2048 -keyout private-key.key -out certificate.crt -days 365 -nodes

NOTE: Regardless of the method you choose, the certificate you upload to the App registration must be in one of the following supported formats: .cer, .crt, or .pem.

After generating the certificate:

1. Navigate to your App registration in the Azure Portal.
2. Go to Certificates & secrets > Certificates.
3. Click Upload certificate, and select a valid .cer, .crt, or .pem file.

Create a user in Azure SQL Database

To allow your Service Principal to connect to the Azure SQL Database, run the following command. Replace <PRINCIPAL-NAME> with the name of your Service Principal:

CREATE USER [<PRINCIPAL-NAME>] FROM EXTERNAL PROVIDER;

NOTE: You’ll grant the appropriate database permissions to this Service Principal user in the Grant user permissions step later.

• Avoid sharing usernames or passwords with Fivetran
• Maintain control over access permissions via Azure roles or groups
• Revoke access at any time through the Microsoft Entra ID portal

IMPORTANT:

• You must have a properly configured Microsoft Entra ID tenant within your Azure account.
• Your Azure SQL Database must be configured to support Entra ID authentication.
• Your Azure SQL logical server must have an Active Directory administrator assigned. This role is required to create Entra ID users in the database and enable Fivetran to authenticate using Entra ID.
• Follow Azure’s official guide for setup.

Retrieve your Entra ID Tenant ID

1. Open the Azure Portal and sign in.

2. Go to Azure Active Directory.

3. In the left-hand menu, click Properties.

   

4. Copy the value labeled Tenant ID. You will need to enter this in the Fivetran connection setup form later.

   

Create a user in Azure SQL Database

Even though Fivetran authenticates via OAuth, your database still requires a mapped user to issue queries. The user can be an individual account or a group that has been assigned access.

In your Azure SQL Database, run the following command. Replace <PRINCIPAL-NAME> with either of the following:

• The User Principal Name (UPN) of the Entra ID user (e.g., user@yourdomain.com)

• The Group Principal Name, if the user is a member of an Entra security group authorized to access the database

   CREATE USER [<PRINCIPAL-NAME>] FROM EXTERNAL PROVIDER;
  

  NOTE: You’ll grant the database permissions to this Entra ID user or group in the Grant user permissions step later.

IMPORTANT: You must have TLS enabled on your database to connect directly to Fivetran. Follow Azure's TLS setup instructions to enable TLS on your database.

Fivetran connects directly to your database instance. This is the simplest connection method.

To connect directly, create a firewall rule to allow access to Fivetran's IPs for your database's region.

Fivetran connects to a separate server in your network that provides an SSH tunnel to your database. You must connect through SSH if your database is in an inaccessible subnet on a virtual network.

You must create a firewall rule to allow access to your SSH tunnel server's IP address.

To connect using SSH, do the following:

1. In the connection setup form, select Connect via an SSH tunnel as the Connection Method.

2. Make a note of the Public Key. You will need it to set up your SSH client.

3. Follow our SSH connection instructions. If you want Fivetran to tunnel SSH over TLS, follow Azure's TLS setup instructions to enable TLS on your database.

IMPORTANT: You must have a Business Critical plan to use Azure Private Link.

Azure Private Link allows Virtual Networks (VNets) and Azure-hosted or on-premises services to communicate with one another without exposing traffic to the public internet. Learn more in Microsoft's Azure Private Link documentation.

Follow our Azure PrivateLink setup guide to configure Private Link for your database.

Fivetran connects to your database through the Proxy Agent, providing secure communication between Fivetran processes and your database host. The Proxy Agent is installed in your network and creates an outbound network connection to the Fivetran-managed SaaS.

To learn more about the Proxy Agent, how to install it, and how to configure it, see our Proxy Agent documentation.

1. Enable change tracking at the database level:

   ALTER DATABASE [<database>] 
   SET CHANGE_TRACKING = ON 
   (CHANGE_RETENTION = 7 DAYS, AUTO_CLEANUP = ON);
   

   NOTE: While we recommend seven days of change retention, you can set your retention period as low as one day. However, a shorter retention period increases the risk that your logs will expire in between syncs, triggering an automatic full source re-sync.

2. Enable CT for each table you want to integrate:

   ALTER TABLE [<schema>].[<table>] ENABLE CHANGE_TRACKING;
   

3. Grant the Fivetran user VIEW CHANGE TRACKING permission for each of the tables that have change tracking enabled:

   GRANT VIEW CHANGE TRACKING ON [<schema>].[<table>] TO <username>;
   

1. Enable change data capture at the database level:

   USE TEST;
   EXEC sys.sp_cdc_enable_db;
   

2. Enable CDC for each table you want to integrate:

   EXEC sys.sp_cdc_enable_table  
   @source_schema = [<schema>],
   @source_name   = [<table>],
   @role_name     = [<username>],
   @supports_net_changes = 0;
   

   NOTE: Fivetran only supports tables with a single CDC capture instance. Our syncs only include tables and columns that are present in a CDC instance. If you add new tables or columns, you must create a new CDC instance that includes them and delete the old instance.

   NOTE: When @supports_net_changes is set to 1, an additional non-clustered index is created on the change table. Because this index needs to be maintained, enabling net changes can degrade CDC performance.

3. Set your CDC retention period:

   EXEC sys.sp_cdc_change_job
   @job_type = N'cleanup',
   @retention = 10080; -- Sets the retention period to 7 days
   

   NOTE: While we recommend seven days of change retention, you can set your retention period as low as one day. However, a shorter retention period increases the risk that your logs will expire in between syncs, triggering an automatic full source re-sync.

1. Install the following script on your database. Before running the script, replace <database> with your database name.

   NOTE: If you have configured your connector to "Allow columns", you can exclude the [dbo].[sp_ft_enable_cdc] and [dbo].[sp_ft_enable_change_tracking] stored procedures. If you have configured your connector to "Block All", you can exclude all the following stored procedures.

   USE [<database>];
   
   /****** Object:  StoredProcedure [dbo].[sp_ft_enable_cdc]    Script Date: 1/17/2024 11:12:55 PM ******/
   SET ANSI_NULLS ON
   GO
      
   SET QUOTED_IDENTIFIER ON
   GO
      
   CREATE OR ALTER PROCEDURE [dbo].[sp_ft_enable_cdc]
      @TableList NVARCHAR(MAX),
      @FivetranUser NVARCHAR(MAX)
   WITH EXECUTE AS OWNER -- Change to an appropriate sysadmin user
   AS
   BEGIN
      SET NOCOUNT ON;
   
      -- Table to store tables with results
      CREATE TABLE #ResultTables (TableName NVARCHAR(MAX), Result NVARCHAR(MAX));
   
      -- Enable CDC for each table
      DECLARE @TableName NVARCHAR(MAX);
      DECLARE @SqlStatement NVARCHAR(MAX);
   
      WHILE LEN(@TableList) > 0
      BEGIN
         -- Get the first table in the list
         SET @TableName = NULL;
         SET @TableName = SUBSTRING(@TableList, 1, CHARINDEX(',', @TableList + ',') - 1);
   
         -- Remove the processed table from the list
         SET @TableList = STUFF(@TableList, 1, LEN(@TableName) + 1, '');
   
         -- Build and execute the SQL statement to enable CDC for the table
         SET @SqlStatement = '
         BEGIN TRY
            EXEC sys.sp_cdc_enable_table
                @source_schema = ''' + PARSENAME(@TableName, 2) + ''',
                @source_name   = ''' + PARSENAME(@TableName, 1) + ''',
                @role_name     = ''' + @FivetranUser + ''',
                @supports_net_changes = 0;
            
            INSERT INTO #ResultTables (TableName, Result) VALUES (''' + @TableName + ''', ''Success'');
         END TRY
         BEGIN CATCH
            PRINT ERROR_MESSAGE();
            INSERT INTO #ResultTables (TableName, Result) VALUES (''' + @TableName + ''', ERROR_MESSAGE());
         END CATCH
         ';
   
        -- Execute the dynamic SQL statement
        EXEC sp_executesql @SqlStatement;
      END
   
      -- Return the list of tables with results
      SELECT * FROM #ResultTables;
         
      -- Drop the temporary table
      DROP TABLE #ResultTables;
   END;
   GO
   
   
   /****** Object:  StoredProcedure [dbo].[sp_ft_enable_change_tracking]    Script Date: 1/17/2024 11:10:45 PM ******/
   SET ANSI_NULLS ON
   GO
      
   SET QUOTED_IDENTIFIER ON
   GO
      
   CREATE OR ALTER PROCEDURE [dbo].[sp_ft_enable_change_tracking]
      @TableList NVARCHAR(MAX),
      @FivetranUser NVARCHAR(MAX)
   WITH EXECUTE AS OWNER -- Change to an appropriate sysadmin user
   AS
   BEGIN
      SET NOCOUNT ON;
         
      -- Table to store tables with results
      CREATE TABLE #ResultTables (TableName NVARCHAR(MAX), Result NVARCHAR(MAX));
         
      -- Enable change tracking for each table
      DECLARE @TableName NVARCHAR(MAX);
      DECLARE @SqlStatement NVARCHAR(MAX);
         
      WHILE LEN(@TableList) > 0
      BEGIN
         -- Get the first table in the list
         SET @TableName = NULL;
         SET @TableName = SUBSTRING(@TableList, 1, CHARINDEX(',', @TableList + ',') - 1);
         
         -- Remove the processed table from the list
         SET @TableList = STUFF(@TableList, 1, LEN(@TableName) + 1, '');
            
         -- Build and execute the SQL statement to enable change tracking
         SET @SqlStatement = '
         BEGIN TRY
            ALTER TABLE ' + @TableName + ' ENABLE CHANGE_TRACKING;
            GRANT VIEW CHANGE TRACKING ON ' + @TableName + ' TO ' + @FivetranUser + ';
            INSERT INTO #ResultTables (TableName, Result) VALUES (''' + @TableName + ''', ''Success'');
         END TRY
         BEGIN CATCH
            PRINT ERROR_MESSAGE();
            INSERT INTO #ResultTables (TableName, Result) VALUES (''' + @TableName + ''', ERROR_MESSAGE());
         END CATCH
         ';
            
         -- Execute the dynamic SQL statement
         EXEC sp_executesql @SqlStatement;
      END
         
      -- Return the list of tables with results
      SELECT * FROM #ResultTables;
         
      -- Drop the temporary table
      DROP TABLE #ResultTables;
   END;
   GO
   
     
   /****** Object:  StoredProcedure [dbo].[sp_ft_get_tables_with_ddl_changes]    Script Date: 1/30/2024 9:10:47 PM ******/
   SET ANSI_NULLS ON
   GO
      
   SET QUOTED_IDENTIFIER ON
   GO
   
   CREATE OR ALTER PROCEDURE [dbo].[sp_ft_get_tables_with_ddl_changes]
      @TableList NVARCHAR(MAX),
      @ddlTime DATETIME = NULL -- New parameter for ddlTime
   WITH EXECUTE AS OWNER -- Change to an appropriate sysadmin user
   AS
   BEGIN
      SET NOCOUNT ON;
   
      -- Declare a table variable to store the results
      DECLARE @ChangedTables TABLE (
         TableName NVARCHAR(MAX),
         DdlTime DATETIME
      );
   
      -- Split the comma-separated list into a table variable
      DECLARE @TableNames TABLE (
         TableName NVARCHAR(MAX)
      );
         
      INSERT INTO @TableNames (TableName)
      SELECT value
      FROM STRING_SPLIT(@TableList, ',');
         
      -- Check for DDL changes in cdc.ddl_history
      INSERT INTO @ChangedTables (TableName, DdlTime)
      SELECT
         tn.TableName,
         MAX(dh.ddl_time) AS LatestDdlTime
      FROM cdc.ddl_history dh
      INNER JOIN @TableNames tn ON CONCAT(OBJECT_SCHEMA_NAME(dh.source_object_id), '.', OBJECT_NAME(dh.source_object_id)) = tn.TableName
      WHERE @ddlTime IS NULL OR dh.ddl_time >= @ddlTime
      GROUP BY tn.TableName;
         
      -- Return the list of tables with the latest DDL changes
      SELECT TableName, DdlTime
      FROM @ChangedTables;
   END;
   GO
   
   
   
   /****** Object:  StoredProcedure [dbo].[sp_ft_update_cdc]    Script Date: 1/31/2024 1:19:40 AM ******/
   SET ANSI_NULLS ON
   GO
   
   SET QUOTED_IDENTIFIER ON
   GO
   
   CREATE OR ALTER PROCEDURE [dbo].[sp_ft_update_cdc]
      @TableName NVARCHAR(MAX),
      @FivetranUser NVARCHAR(MAX),
      @CaptureInstance NVARCHAR(MAX),
      @CapturedColumnList NVARCHAR(MAX)
   WITH EXECUTE AS OWNER
   AS
   BEGIN
      SET NOCOUNT ON;
   
       -- Table to store tables with results
       CREATE TABLE #ResultTables (TableName NVARCHAR(MAX), Result NVARCHAR(MAX));
   
       DECLARE @SourceSchema NVARCHAR(MAX);
       DECLARE @SourceName NVARCHAR(MAX);
   
       BEGIN TRY
           -- Assign values to variables for PARSENAME function
           SET @SourceSchema = PARSENAME(@TableName, 2);
           SET @SourceName = PARSENAME(@TableName, 1);
   
           -- Step 1: Disable the current CDC instance
           EXEC sys.sp_cdc_disable_table
               @source_schema    = @SourceSchema,
               @source_name      = @SourceName,
               @capture_instance = @CaptureInstance;
   
           -- Step 2: Create a new CDC instance
           EXEC sys.sp_cdc_enable_table
               @source_schema        = @SourceSchema,
               @source_name          = @SourceName,
               @role_name            = @FivetranUser,
               @capture_instance     = @CaptureInstance,
               @captured_column_list = @CapturedColumnList,
               @supports_net_changes = 0;
   
           -- Insert the result into the #ResultTables table
           INSERT INTO #ResultTables (TableName, Result) VALUES (@TableName, 'Success');
       END TRY
       BEGIN CATCH
           PRINT ERROR_MESSAGE();
           -- Insert the error message into the #ResultTables table
           INSERT INTO #ResultTables (TableName, Result) VALUES (@TableName, ERROR_MESSAGE());
       END CATCH;
   
       -- Return the list of tables with results
       SELECT * FROM #ResultTables;
   
       -- Drop the temporary table
       DROP TABLE #ResultTables;
   END;
   GO
   
   

2. Grant the Fivetran user execute permission.

   USE [<database>];
   GRANT EXECUTE ON dbo.sp_ft_enable_cdc to <username>;
   GRANT EXECUTE ON dbo.sp_ft_enable_change_tracking to <username>;
   GRANT EXECUTE ON dbo.sp_ft_get_tables_with_ddl_changes to <username>;
   GRANT EXECUTE ON dbo.sp_ft_update_cdc to <username>;