I'm trying to make a copy of a database in Azure. This requires that the user logged in be the db_owner of the database.
Unfortunately the person who created the database has left and we don't have their login credentials and they don't remember them either.
Is there any way to change the db_owner in Azure databases?
Note: Doing EXEC sp_addrolemember 'db_owner', 'login1User' doesn't work for this as the actual owner account is needed to copy a database in Azure.
ALTER AUTHORIZATION ON DATABASE::<YourDatabaseName> to [NewOwner];
You probably want to reset the password on the server (not the database). When you click on "SQL Databases" tab on the portal, you'll go to a list of your databases. On there there will be a
"Server" column. The entries in that column are hyperlinks. Click on the server you don't know the password for. on the Dashboard page for the server for the SQL Database you'll see a "Reset Administrator Password" link on the right under "quick glance".
Once you do that you can log into the management console for the database and change the logins for the database with ALTER LOGIN
To my knowledge there is no way to do this. Try looking in the former employees code for connections strings and hardcoded passwords.
You can also review this guide to see if there are any commands that may help you: Managing Databases and Logins in Windows Azure SQL Database
Related
Can someone tell me how can I add Azure Active Directory groups into the azure sql server, I am using server manager tool to do this but cant find any way to figure this out, I can add simple Azure Active Directory user though..What about groups?
I will assume that you are wanting to provide access for end-users to connect, not Database Administrators. For my example below, let's say that the end-users are in a group called "AZ-Users", and that your Database Administrators (including you) are in a group called "AZ-DBAs".
For Azure SQL Databases, there are key things that must be in place to get this to work:
There must be an "Active Directory admin" configured for your server. This can be any AAD user or an AAD group. You can check if this has been set or not by going to the Azure portal page for your server. Be careful that you are looking at the Overview page for the server, not the individual database, they are not the same thing. Detailed instructions here. In our example, we would configure this to be the AAD group called "AZ-DBAs".
When you are ready to create the AAD login for "AZ-Users" on your Azure SQL Database, you must yourself be logged in using AAD... meaning a member of the "AZ-DBAs" group from my example above. You can use SSMS or any other similar tool for executing TSQL commands. Note that if you try a SQL auth connection instead, it won't work for step 4 below - you'll get this error:
Msg 33159, Level 16, State 1, Line 1
Principal 'AZ-Users' could not be created. Only connections established with Active Directory accounts can create other Active Directory users.
Change the context to the database you want to provide access to for your end users.
Execute this statement:
CREATE USER [AZ-Users] FROM EXTERNAL PROVIDER
Note that this will create a "contained database user", as detailed here. That's it. This process works for AAD groups and AAD users.
You will probably also want to grant some level of permissions as well, such as:
EXEC sp_addrolemember 'db_datareader', 'AZ-Users'
All you need to know about how to configure and manage Azure Active Directory Authentication you can find it in this article.
Then to connect to SQL Azure using Azure Active Directory authentication please read here.
Connect to the server via SSMS as your Azure AD admin. Create a new query with the db you want to affect. Run this:
ALTER ROLE db_datareader ADD MEMBER [AzureADGroupName];
GO
To modify permissions, do something like this:
ALTER ROLE db_datareader ADD MEMBER [AzureADGroupName];
GO
In my SQL Server 2012 I have created a server role. I would like the server role can alter just one database one the server because I have many database on the server. How can I grant access for alter data in one database on the server?
Thank you in advance,
Nico.
Presumably you have just added the login to the server. Unless you have given the login sysadmin (I presume you have not), you will need to individually set the security per database ie. map the user to the database, e.g.
USE [Database]
GO
CREATE USER [User] FOR LOGIN [User] WITH DEFAULT_SCHEMA=[dbo]
GO
You will need to add the user to Security/Users in the actual database folder. If you want them to read/write data into/from existing tables, give them db_datareader and db_datawriter by right clicking and going to Properties -> Membership. If you want them to be able to create/drop objects in the database e.g. tables, they also need db_owner. They only have the rights for that db.
In addition of what TJB said, please document on : https://msdn.microsoft.com/ro-ro/library/ms178569.aspx
I created SQL DB. and I want to allow only "DB owner" to access stored procedures. I want to prevent all other users including 'sa' user from doing that . how to do that ?
short answer: you can't.
long answer: sa is the owner of the whole server so cannot be cut out of anything on the server. you can prevent all other users (that does not have a sysadmin role) from using the stored procedures but again you have no way to lock out sa and/or any user with sysadmin role.
you may revoke permission to SA but SA can grant these permissions back easily.
actually you may lock out SA user if you disable SQL authentication or disable the user but anyway you cannot prevent other users with sysadmin role to interact with the stored procedures: this is by design.
please post a question with the actual requirement: this question looks like a solution you are trying to implement; maybe we can help you find a suitable solution for the actual issue.
as a side note, if you don't trust the admin of the server there is something wrong...
Here on my company we have a SQL Database with several users. However everyone knows the password of 'sa' user.
Now, we have create a Intranet and it is necessary to limit the access to the Intranet database.
I have tryed to create a new owner and remove the permissions from 'sa' user to this database but with no success. What it is more recommended?
Continue this or create a new password for this specific database (is this possible)?
Thanks in advance
I would simply suggest reset the SA account's password. Very very few people should know this password ever. If you need to give specific people this access, then create accounts for them. Applications should almost never have this level of access.
Edit: In MS Sql Server you can have a user on the server level with no access, and then you make that user DBO in a specific database - this enables a user to "admin" a database without being able to mess with the server settings.. This is highly recommended imho.
Here is a detailled guide on how to do it:
First make a login:
http://msdn.microsoft.com/en-us/library/aa337562.aspx
Then give that user access to the DB:
http://msdn.microsoft.com/en-us/library/aa337545.aspx
Don't use SQL Server logins
Use windows logins. When the user should not have access, remove the windows login. You can't make people forget a password but you can revoke windows login access.
I am trying to give permissions to a user I just created and has a login associated logged into my master.
I was not able to give any permissions since it says you do not have permissions to do this.
I gave myself dbowner rights in the master but still.
Any help?
Might it be that the database I created does not have the schema dbo?
UPDATE:
I thought you said the user you added didn't have any permissions, my bad! Well the answer still might be helpful :-)
I'm not an SQL expert so this may not answer your question, but I had to do something like this today and listing my steps might help.
You can use a graphical tool like Azure User Management Console (AUMC) if you want to add users without having to write a bunch of SQL queries.
Connect to your server, go to Logins and create a new login (if you want to give server access as well), then go to Users, select your database, create a new user, then here you can link the user to the login you just created and give database permissions.
Here is the documentation on granting users/logins permissions:
http://blogs.msdn.com/b/sqlazure/archive/2010/06/21/10028038.aspx
EXEC sp_addrolemember 'db_datareader', 'readonlyuser';