security-center-for-sql-server-database-engine-and-azure-sql-database.md

title	description	author	ms.author	ms.date	ms.service	ms.subservice	ms.topic	helpviewer_keywords	monikerRange
Security documentation for SQL Server & Azure SQL Database	A reference of security and protection-related content for SQL Server and Azure SQL Database.	VanMSFT	vanto	09/27/2017	sql	security	conceptual	SQL Server, security security [SQL Server] database security [SQL Server] databases [SQL Server], security	>=aps-pdw-2016||=azuresqldb-current||=azure-sqldw-latest||>=sql-server-2016||>=sql-server-linux-2017||=azuresqldb-mi-current

Security for SQL Server Database Engine and Azure SQL Database

[!INCLUDESQL Server Azure SQL Database Synapse Analytics PDW]

This page provides links to help you locate the information that you need about security and protection in the [!INCLUDEssDEnoversion] and [!INCLUDE ssazure-sqldb].

Legend

Authentication: Who are you?

Feature	Link
Who Authenticates? :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Windows Authentication :::image type="icon" source="../performance/media/security-center-both.png"::: [!INCLUDEssNoVersion] Authentication :::image type="icon" source="../../relational-databases/security/media/security-center-both.png"::: Microsoft Entra ID (formerly Azure Active Directory)	Who Authenticates? (Windows or [!INCLUDEssNoVersion]) Choose an Authentication Mode Connect to Azure SQL with Microsoft Entra authentication
Where Authenticated? :::image type="icon" source="../performance/media/security-center-both.png"::: At master Database: Logins and DB Users :::image type="icon" source="../performance/media/security-center-both.png"::: At User Database: Contained DB Users	Authenticate at the master database (Logins and database users) Create a SQL Server Login Managing Databases and Logins in Azure SQL Database Create a Database User Authenticate at a user database Contained Database Users - Making Your Database Portable
Using Other Identities :::image type="icon" source="../performance/media/security-center-both.png"::: Credentials :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Execute as Another Login :::image type="icon" source="../performance/media/security-center-both.png"::: Execute as Another Database User	Credentials (Database Engine) Execute as Another Login Execute as Another Database User

Authorization: What can you do?

Feature	Link
Granting, Revoking, and Denying Permissions :::image type="icon" source="../performance/media/security-center-both.png"::: Securable Classes :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Granular Server Permissions :::image type="icon" source="../performance/media/security-center-both.png"::: Granular Database Permissions	Permissions Hierarchy (Database Engine) Permissions Securables Getting Started with Database Engine Permissions
Security by Roles :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Server Level Roles :::image type="icon" source="../performance/media/security-center-both.png"::: Database Level Roles	Server-Level Roles Database-Level Roles
Restricting Data Access to Selected Data Elements :::image type="icon" source="../performance/media/security-center-both.png"::: Restrict Data Access With Views/Procedures :::image type="icon" source="../performance/media/security-center-both.png"::: Row-Level Security :::image type="icon" source="../performance/media/security-center-both.png"::: Dynamic Data Masking :::image type="icon" source="../performance/media/security-center-both.png"::: Signed Objects	Restrict Data Access Using Views and Procedures Row-Level Security (SQL Server) Row-Level Security (Azure SQL Database) Dynamic Data Masking (SQL Server) Dynamic Data Masking (Azure SQL Database) Signed Objects

Encryption: Storing Secret Data

Feature	Link
Encrypting Files :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: BitLocker Encryption (Drive Level) :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: NTFS Encryption (Folder Level) :::image type="icon" source="../performance/media/security-center-both.png"::: Transparent Data Encryption (File Level) :::image type="icon" source="../performance/media/security-center-both.png"::: Backup Encryption (File Level)	BitLocker (Drive Level) NTFS Encryption (Folder Level) Transparent Data Encryption (File Level) Backup Encryption (File Level)
Encrypting Sources :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Extensible Key Management Module :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Keys Stored in the Azure Key Vault :::image type="icon" source="../performance/media/security-center-both.png"::: Always Encrypted	Extensible Key Management Module Keys Stored in the Azure Key Vault Always Encrypted
Column, Data, & Key Encryption :::image type="icon" source="../performance/media/security-center-both.png"::: Encrypt by Certificate :::image type="icon" source="../performance/media/security-center-both.png"::: Encrypt by Symmetric Key :::image type="icon" source="../performance/media/security-center-both.png"::: Encrypt by Asymmetric Key :::image type="icon" source="../performance/media/security-center-both.png"::: Encrypt by Passphrase	Encrypt by Certificate Encrypt by Asymmetric Key Encrypt by Symmetric Key Encrypt by Passphrase Encrypt a Column of Data

Connection Security: Restricting and Securing

Feature	Link
Firewall Protection :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Windows Firewall Settings :::image type="icon" source="../../relational-databases/security/media/security-center-sqldb.png"::: Azure Service Firewall Settings :::image type="icon" source="../../relational-databases/security/media/security-center-sqldb.png"::: Database Firewall Settings	Configure a Windows Firewall for Database Engine Access Azure SQL Database Firewall Settings Azure Service Firewall Settings
Encrypting Data in Transit :::image type="icon" source="../performance/media/security-center-both.png"::: Forced SSL Connections :::image type="icon" source="../performance/media/security-center-sqlserver.png"::: Optional SSL Connections	Enable Encrypted Connections to the Database Engine Enable Encrypted Connections to the Database Engine, Network security TLS 1.2 support for Microsoft SQL Server

Auditing: Recording Access

Feature	Link
Automated Auditing :::image type="icon" source="../../relational-databases/performance/media/security-center-sqlserver.png"::: [!INCLUDEssNoVersion] Audit (Server and DB Level) :::image type="icon" source="../../relational-databases/security/media/security-center-sqldb.png"::: [!INCLUDEssSDS] Audit (Database Level) :::image type="icon" source="../../relational-databases/security/media/security-center-sqldb.png"::: Detect threats	SQL Server Audit (Database Engine) SQL Database Auditing Get started with SQL Database Advanced Threat Protection SQL Database Vulnerability Assessment
Custom Audit :::image type="icon" source="../../relational-databases/performance/media/security-center-both.png"::: Triggers	Custom Audit Implementation: Creating DDL Triggers and DML Triggers
Compliance :::image type="icon" source="../../relational-databases/performance/media/security-center-both.png"::: Compliance	SQL Server: Common Criteria SQL Database: Microsoft Azure Trust Center: Compliance by Feature

SQL Injection

SQL injection is an attack in which malicious code is inserted into strings that are later passed to the [!INCLUDEssDE] for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because [!INCLUDEssNoVersion] will execute all syntactically valid queries that it receives. All database systems have some risk of SQL Injection, and many of the vulnerabilities are introduced in the application that is querying the [!INCLUDEssDE]. You can thwart SQL injection attacks by using stored procedures and parameterized commands, avoiding dynamic SQL, and restricting permissions on all users. For more information, see SQL Injection.

Additional links for application programmers:

• Application Security Scenarios in SQL Server

• Writing Secure Dynamic SQL in SQL Server

• How To: Protect From SQL Injection in ASP.NET

See Also

Getting Started with Database Engine Permissions
Securing SQL Server
Principals (Database Engine)
SQL Server Certificates and Asymmetric Keys
SQL Server Encryption
Surface Area Configuration
Strong Passwords
TRUSTWORTHY Database Property
Database Engine Features and Tasks
Protecting Your SQL Server Intellectual Property

[!INCLUDEget-help-security]