MS SQL Integration Overview

The ObserveID MS SQL integration retrieves native SQL logins and their access information from the MS SQL server as the source system and aggregates it into the ObserveID platform as the data consumer by leveraging the Microsoft.Data.SqlClient library. This enables centralized visibility, governance, and control over server-level principals, facilitates access reviews across databases and specific tables, and supports entitlement cataloging across the whole range of server-level and database-level permission types, like: fixed and user-defined roles, server and database grants and database object grants.

The base configuration of the MS SQL integration supports access analytics and access governance, with optional extensions for full lifecycle management and policy-driven access control.

Optional extension of the base configuration provides a secure layer for account administration and supports self-service access and credential management. In addition, it enables tightly controlled user provisioning and deprovisioning, role management, and privileged access management. The integration also provides the access detection and blocked list capabilities, audit evidence—such as access history, audit logs, and policy violations—and orchestrates complex business-driven processes, including onboarding, certification escalation, remediation campaigns, and access change approvals.

Base configuration

The initial setup of the integration enables data aggregation and synchronization. To support full read-write functionality, additional configuration is required to align the integration with the organization’s business context, security policies, and compliance requirements

The base configuration includes the following steps:

  1. Required prerequisites must be configured in MS SQL for ObserveID.
  2. Connection parameters must be configured in ObserveID for MS SQL.
  3. The initial data load from MS SQL to ObserveID must be completed successfully.

Baseline capabilities

Once the base integration setup is complete, the following standard read-only capabilities are available:

  • Aggregation and synchronization of native SQL logins; assigned roles and grants; permission catalogues to govern access to each of the resources on the server; and the server, databases, and tables as resources based on the baseline schema.
  • Access analytics and risk analysis across users, privileges, and resources.
  • Access reviews and certification, provided that a ticketing system is integrated.

Optional configuration

Additional configuration enables read-write and governance capabilities, including:

  • Identity lifecycle management, which requires configuration of MS SQL account correlation logic and customization based on account types, such as user accounts, privileged accounts, service accounts, firecall accounts, orphaned accounts.
  • Access control and account administration, which require configuration of MS SQL account attributes through provisioning rules.
  • Custom account attributes, enabled through optional attribute configuration.
  • Automated access provisioning for onboarding/reinstatement scenarios, which requires configuration of the birthright access assignment.
  • Automated access termination for offboarding scenarios, which requires configuration of the leaver rule.
  • Remote Connect, enabled through additional Windows machine configuration and MS SQL integration remote settings.
  • Session Recording, which requires additional storage allocation and administrative configuration.
  • Access Detection with Text Logs, which requires SQL Server audit log file configuration.
  • Blocked List capability, which requires installation of the agent and subsequent configuration.
  • Other custom integration operations, driven by specific business or security requirements.

The MS SQL integration enables centralized control over the full account lifecycle, supports role-based access control (RBAC), and provides near real-time visibility into access-related activities. This approach reduces the risk of unauthorized access while ensuring auditability, policy compliance, and operational consistency at scale.