You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: SQL Auditing for Azure SQL Database and Azure Synapse Analytics tracks database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs.
5
5
author: WilliamDAssafMSFT
6
6
ms.author: wiassaf
7
-
ms.reviewer: srsaluru, vanto, mathoma
8
-
ms.date: 03/30/2026
7
+
ms.reviewer: peskount, srsaluru, vanto, mathoma
8
+
ms.date: 04/15/2026
9
9
ms.service: azure-sql-database
10
10
ms.subservice: security
11
11
ms.topic: concept-article
@@ -56,11 +56,11 @@ You can use SQL Database auditing to:
56
56
57
57
### Recommended auditing approach for large OLTP workloads
58
58
59
-
For environments with many databases running heavy OLTP workloads, using server‑level auditing with default settings can lead to very large audit volumes across the logical server. Since all events from all databases are written into the same audit folder, querying audit logs for a single database becomes slow and operationally expensive. To improve performance and reduce noise:
59
+
For environments with many databases running heavy OLTP workloads, using server-level auditing with default settings can lead to very large audit volumes across the logical server. Since all events from all databases are written into the same audit folder, querying audit logs for a single database becomes slow and operationally expensive. To improve performance and reduce noise:
60
+
61
+
-**Switch to database-level auditing**. Each database writes to its own audit log folder, reducing the total volume scanned and making retrieval faster.
62
+
-**Review the audit configuration**. Determine whether capturing all batch-completed events is necessary, or if a custom filtered configuration can meet your security and compliance requirements.
60
63
61
-
-**Switch to database‑level auditing**. Each database writes to its own audit log folder, reducing the total volume scanned and making retrieval faster.
62
-
-**Review the audit configuration**. Determine whether capturing all batch‑completed events is necessary, or if a custom filtered configuration can meet your security and compliance requirements.
63
-
64
64
## Auditing limitations
65
65
66
66
- Enabling auditing on a paused **Azure Synapse SQL pool** isn't supported. To enable auditing, resume the **Synapse SQL pool**.
@@ -69,7 +69,7 @@ For environments with many databases running heavy OLTP workloads, using server
69
69
70
70
> [!NOTE]
71
71
> For Azure Synapse Analytics, auditing to a storage account behind a VNet requires the server's **system-assigned managed identity** with the **Storage Blob Data Contributor** role. User-assigned managed identities (UAMI) aren't supported for Synapse auditing. If you need to audit to a storage account that uses Microsoft Entra-only authentication, configure the system-assigned managed identity on the server and grant it the Storage Blob Data Contributor role on the target storage account. For more information, see [Write audit to a storage account behind VNet and firewall](audit-write-storage-account-behind-vnet-firewall.md).
72
-
- Due to performance constraints, we don't audit the **tempdb** and **temporary tables**. While the batch completed action group captures statements against temporary tables, it might not correctly populate the object names. However, the source table is always audited, ensuring that all inserts from the source table to temporary tables are recorded.
72
+
- Due to performance constraints, we don't audit the `tempdb` and **temporary tables**. While the batch completed action group captures statements against temporary tables, it might not correctly populate the object names. However, the source table is always audited, ensuring that all inserts from the source table to temporary tables are recorded.
73
73
- Auditing for **Azure Synapse SQL pools** supports default audit action groups **only**.
74
74
- When you configure auditing for a [logical server in Azure](logical-servers.md) or Azure SQL Database with the log destination as a storage account, the authentication mode must match the configuration for that storage account. If using storage access keys as the authentication type, the target storage account must be enabled with access to the storage account keys. If the storage account is configured to only use authentication with Microsoft Entra ID ([formerly Azure Active Directory](/entra/fundamentals/new-name)), auditing can be configured to use managed identities for authentication.
75
75
@@ -79,8 +79,9 @@ For environments with many databases running heavy OLTP workloads, using server
79
79
80
80
## Remarks
81
81
82
+
- Events initiated by `SQLDBControlPlaneFirstPartyApp` in the Activity log are an internal Azure function of the [Azure SQL Database control plane](/azure/azure-resource-manager/management/control-plane-and-data-plane#control-plane). Events initiated by `SQLDBControlPlaneFirstPartyApp` are part of an internal synchronization operation between the SQL engine and Azure Resource Manager. These events are a normal part of Azure SQL Database management and are required for correct resource representation and operation in Azure.
82
83
-**Premium storage** with **BlockBlobStorage** is supported. Standard storage is supported. However, for audit to write to a storage account behind a virtual network or firewall, you must have a **general-purpose v2 storage account**. If you have a general-purpose v1 or Blob Storage account, [upgrade to a general-purpose v2 storage account](/azure/storage/common/storage-account-upgrade). For specific instructions see, [Write audit to a storage account behind VNet and firewall](audit-write-storage-account-behind-vnet-firewall.md). For more information, see [Types of storage accounts](/azure/storage/common/storage-account-overview#types-of-storage-accounts).
83
-
- When customers enable SQL auditing and also configure **outbound networking** restrictions, they must allow list the fully qualified domain names of their auditing storage account to ensure audit events can successfully reach the destination. If the storage endpoint isn't allowlisted, audit traffic is blocked, resulting in audit event loss. After adding the required storage account FQDNs to the allow list, customers must **re‑save** their auditing configuration to resume normal audit event flow.
84
+
- When customers enable SQL auditing and also configure **outbound networking** restrictions, they must allow list the fully qualified domain names of their auditing storage account to ensure audit events can successfully reach the destination. If the storage endpoint isn't allowlisted, audit traffic is blocked, resulting in audit event loss. After adding the required storage account FQDNs to the allow list, customers must **re-save** their auditing configuration to resume normal audit event flow.
84
85
-**Hierarchical namespace** for all types of **standard storage account** and **premium storage account with BlockBlobStorage** is supported.
85
86
- Audit logs are written to **Append Blobs** in an Azure Blob Storage on your Azure subscription
86
87
- Audit logs are in .xel format and can be opened with [SQL Server Management Studio (SSMS)](/ssms/sql-server-management-studio-ssms).
@@ -98,5 +99,4 @@ For environments with many databases running heavy OLTP workloads, using server
98
99
-[What's New in Azure SQL Auditing](/shows/data-exposed/server-audit-redesign-for-azure-sql-database-data-exposed)
99
100
-[Get started with Azure SQL Managed Instance auditing](../managed-instance/auditing-configure.md)
100
101
-[Auditing for SQL Server](/sql/relational-databases/security/auditing/sql-server-audit-database-engine)
101
-
102
-
-[Set up Auditing for Azure SQL Database and Azure Synapse Analytics](auditing-setup.md)
102
+
-[Set up Auditing for Azure SQL Database and Azure Synapse Analytics](auditing-setup.md)
Copy file name to clipboardExpand all lines: azure-sql/managed-instance/aad-security-configure-tutorial.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -423,7 +423,7 @@ Cross-database queries are supported for Microsoft Entra accounts with Microsoft
423
423
424
424
- SQL Agent management and job executions are supported for Microsoft Entra logins.
425
425
- Microsoft Entra logins can execute database backup and restore operations.
426
-
- [Auditing](auditing-configure.md) of all statements related to Microsoft Entra logins and authentication events.
426
+
- [Auditing](auditing.md) of all statements related to Microsoft Entra logins and authentication events.
427
427
- Dedicated administrator connection for Microsoft Entra logins that are members of the **sysadmin** server-role.
428
428
- Microsoft Entra logins are supported with using the [sqlcmd utility](/sql/tools/sqlcmd-utility) and [SQL Server Management Studio](/ssms/sql-server-management-studio-ssms) tool.
429
429
- Logon triggers are supported for logon events coming from Microsoft Entra logins.
This article teaches you to configure auditing for [Azure SQL Managed Instance](sql-managed-instance-paas-overview.md). Auditing tracks database events and writes them to an audit log in your Azure storage account.
23
-
24
-
Auditing also:
25
-
26
-
- Helps you maintain regulatory compliance, understand database activity, and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations.
27
-
- Enables and facilitates adherence to compliance standards, although it doesn't guarantee compliance. For more information, see the [Microsoft Azure Trust Center](https://www.microsoft.com/trust-center/compliance/compliance-overview) where you can find the most current list of SQL Managed Instance compliance certifications.
28
-
29
-
> [!IMPORTANT]
30
-
> The auditing of Azure SQL Managed Instance is optimized for availability and performance. During high activity, or high network load, Azure SQL Managed Instance allows operations to proceed and might not record some audited events.
22
+
This article teaches you to configure [auditing with SQL Server Audit in Azure SQL Managed Instance](auditing.md). Auditing tracks database events and writes them to an audit log in your Azure storage account.
31
23
32
24
## Set up auditing for your instance to Azure Storage
33
25
@@ -94,7 +86,7 @@ The following section describes the configuration of auditing on your SQL manage
94
86
95
87
:::image type="content" source="media/auditing-configure/7_sas_configure.png" alt-text="Screenshot showing the SAS configuration.":::
96
88
97
-
- The SAS token appears at the bottom. Copy the token by selecting on the copy icon, and save it (for example, in Notepad) for future use.
89
+
- The SAS token appears at the bottom. Copy the token by selecting the copy icon, and save it (for example, in Notepad) for future use.
98
90
99
91
:::image type="content" source="media/auditing-configure/8_sas_copy.png" alt-text="Screenshot showing how to copy SAS token.":::
100
92
@@ -142,7 +134,7 @@ The following section describes the configuration of auditing on your SQL manage
142
134
143
135
:::image type="content" source="media/auditing-configure/12_mi_SSMS_sign_in_to_azure.png" alt-text="Screenshot showing how to Sign in to Azure.":::
144
136
145
-
1. Select a subscription, storage account, and blob container from the dropdowns, or create your own container by selecting on**Create**. Once you're finished, select **OK**:
137
+
1. Select a subscription, storage account, and blob container from the dropdowns, or create your own container by selecting **Create**. Once you're finished, select **OK**:
@@ -155,8 +147,8 @@ The following section describes the configuration of auditing on your SQL manage
155
147
156
148
After you configure the blob container as target for the audit logs, create and enable a server audit specification or database audit specification as you would for SQL Server:
157
149
158
-
- [Create server audit specification T-SQL guide](/sql/t-sql/statements/create-server-audit-specification-transact-sql)
Use the following T-SQL statement to enable the server audit:
162
154
@@ -168,9 +160,9 @@ Use the following T-SQL statement to enable the server audit:
168
160
169
161
For additional information:
170
162
171
-
- [Auditing differences between Azure SQL Managed Instance and a database in SQL Server](#audit-differences-between-databases-in-azure-sql-managed-instance-and-databases-in-sql-server)
172
-
- [CREATE SERVER AUDIT](/sql/t-sql/statements/create-server-audit-transact-sql)
173
-
- [ALTER SERVER AUDIT](/sql/t-sql/statements/alter-server-audit-transact-sql)
163
+
- [Auditing differences between Azure SQL Managed Instance and a database in SQL Server](auditing.md#audit-differences-between-databases-in-azure-sql-managed-instance-and-databases-in-sql-server)
164
+
- [CREATE SERVER AUDIT](/sql/t-sql/statements/create-server-audit-transact-sql?view=azuresqldb-mi-current&preserve-view=true)
165
+
- [ALTER SERVER AUDIT](/sql/t-sql/statements/alter-server-audit-transact-sql?view=azuresqldb-mi-current&preserve-view=true)
174
166
175
167
## Auditing of Microsoft Support operations
176
168
@@ -214,8 +206,8 @@ Audit logs from a SQL managed instance can be sent to Azure Event Hubs or Azure
214
206
215
207
1. Create and enable a server audit specification or database audit specification as you would for SQL Server:
216
208
217
-
- [Create Server audit specification T-SQL guide](/sql/t-sql/statements/create-server-audit-specification-transact-sql)
There are several methods you can use to view blob auditing logs.
273
265
274
-
- You can use the system function [sys.fn_get_audit_file (T-SQL)](/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql) to return the audit log data in tabular format.
266
+
- You can use the system function [sys.fn_get_audit_file (T-SQL)](/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql?view=azuresqldb-mi-current&preserve-view=true) to return the audit log data in tabular format.
275
267
276
268
- You can explore audit logs by using a tool such as [Azure Storage Explorer](https://azure.microsoft.com/features/storage-explorer/). In Azure Storage, auditing logs are saved as a collection of blob files within a container that was defined to store the audit logs. For more information about the hierarchy of the storage folder, naming conventions, and log format, see the [Blob Audit Log Format Reference](../database/audit-log-format.md).
277
269
@@ -287,38 +279,10 @@ If audit logs are written to Azure Monitor logs, they're available in the Log An
287
279
288
280
Azure Monitor logs gives you real-time operational insights using integrated search and custom dashboards to readily analyze millions of records across all your workloads and servers. For more information about Azure Monitor logs search language and commands, see [Azure Monitor logs search reference](/azure/azure-monitor/logs/log-query-overview).
289
281
290
-
## Audit differences between databases in Azure SQL Managed Instance and databases in SQL Server
291
-
292
-
The key differences between auditing in databases in Azure SQL Managed Instance and databases in SQL Server are:
293
-
294
-
- With Azure SQL Managed Instance, auditing works at the server level and stores `.xel` log files in Azure Blob storage.
295
-
-In SQL Server, audit works at the server level, but stores events in the file system and Windows event logs.
296
-
297
-
XEvent auditing in managed instances supports Azure Blob storage targets. File and Windows logs are **not supported**.
298
-
299
-
The key differences in the `CREATE AUDIT` syntax for auditing to Azure Blob storage are:
300
-
301
-
- A new syntax `TO URL` is provided and enables you to specify the URL of the Azure Blob storage container where the `.xel` files are placed.
302
-
- A new syntax `TO EXTERNAL MONITOR` is provided to enable Event Hubs and Azure Monitor log targets.
303
-
- The syntax `TO FILE` is **not supported** because Azure SQL Managed Instance can't access Windows file shares.
304
-
- Shutdown option is **not supported**.
305
-
- `queue_delay` of 0 is **not supported**.
306
-
307
-
## Permissions
308
-
309
-
To set up auditing, you need database permissions within SQL managed instance, and you also need permissions to the Azure resources that are used for storing and accessing the audit logs.
310
-
311
-
To set up SQL managed instance auditing you need to following database permissions:
312
-
313
-
|Database permissions |Configure audit |View audit logs using T-SQL |
314
-
|---------|---------|---------|
315
-
|**VIEW DATABASE SECURITY AUDIT** |No|Yes|
316
-
|**ALTER ANY DATABASE AUDIT** | Yes | No |
317
-
|**CONTROL DATABASE** | Yes | Yes |
318
-
319
-
To configure auditing to Azure storage, you need the **Storage blob data contributor** role on the storage account or higher permissions. To configure auditing to Event Hubs or Log Analytics, you need the **Monitoring Contributor** role or higher permissions on the resource group where the Event Hub or Log Analytics workspace is provisioned.
320
-
321
-
## Next step
282
+
## Related content
322
283
323
-
> [!div class="nextstepaction"]
324
-
> [Auditing for Azure SQL Database and Azure Synapse Analytics](../database/auditing-overview.md)
284
+
- [SQL Server Audit in Azure SQL Managed Instance](auditing.md)
285
+
- [Create a Server Audit](/sql/relational-databases/security/auditing/create-a-server-audit-and-server-audit-specification?view=azuresqldb-mi-current&preserve-view=true)
286
+
- [Create a server audit and database audit specification](/sql/relational-databases/security/auditing/create-a-server-audit-and-database-audit-specification?view=azuresqldb-mi-current&preserve-view=true)
287
+
- [View a SQL Server Audit Log](/sql/relational-databases/security/auditing/view-a-sql-server-audit-log?view=azuresqldb-mi-current&preserve-view=true)
288
+
- [Write SQL Server Audit events to the Security log](/sql/relational-databases/security/auditing/write-sql-server-audit-events-to-the-security-log?view=azuresqldb-mi-current&preserve-view=true)
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments