Skip to main content

Privacera Platform

Microsoft SQL Server
:

These instructions enable and configure Privacera Microsoft SQL (MS SQL) database connector to an existing MS SQL database running on the Azure cloud platform or the AWS Relational Database Service (RDS). This connector uses the PolicySync method in which access policies defined in Privacera are mapped to and synchronized to the 'native' access controls in MS SQL.

The PolicySync approach has several benefits and advantages:

  • Fine-grained access control - at the database, schema, table, view, and column levels.

  • Column level masking

  • Dynamic row-level filters on tables and views

Prerequisites

The MS SQL Server must already be installed and running.

If you are installing an evaluation, you may need to install and configure an MS SQL Server with one or more databases to test against.

1) Target Database Access

The MS SQL Database server must also be accessible from the Privacera Platform host(s). The standard inbound port for MS SQL Server access is TCP 1433. Make sure that is open 'outbound' from Privacera Platform host(s) and inbound to your target MS SQL server.

2) Access Control by Privacera Service Account

Privacera Platform requires access to the target database and the service account must be established in a 'loginmanager' role. This can be configured in three ways: (1) Access Control on Azure AD Users; (2) Access Control on Local Database Users; or (3) Access Control on both Azure AD user and local users.

Access Control on Azure AD Users

  1. Confirm the MS SQL Server is configured to work with Azure AD Users.

  2. In your Azure AD, create a Privacera 'service' user to be used by Privacera for the Policy access control synchronization. For this example we'll assume the name is 'privacera_policysync@example.com' but set the value appropriately for your domain(s). Keep note of the username and password as we'll use both later.

  3. For each targeted database:

    1. Log on to the target database with an Admin role account.

    2. Execute the following:

      IF DATABASE_PRINCIPAL_ID('privacera_policysync@example.com') IS NULL BEGIN
        CREATE USER [privacera_policysync@example.com] FROM EXTERNAL PROVIDER;
        END;
      
      -- Grant full control on database to privacera_policysync@example.com user
      GRANT CONTROL ON DATABASE::${YOUR_DATABASE} TO [privacera_policysync@example.com];
      

Access Control on Local Database Users

  1. Create a Privacera 'service' user in the master database to be used by Privacera for the Policy access control synchronization. For this example, we'll assume the name is 'privacera_policysync' but set the value appropriately for your domain(s). Keep note of the username and password as we'll use both later.

    IF NOT EXISTS (SELECT name  FROM sys.sql_logins WHERE name = 'privacera_policysync') BEGIN
      CREATE LOGIN [privacera_policysync] WITH PASSWORD = '${PASSWORD}'
      END;
    
    IF DATABASE_PRINCIPAL_ID('privacera_policysync') IS NULL BEGIN
      CREATE USER [privacera_policysync] FROM LOGIN [privacera_policysync];
      END;
    
    EXEC sp_addrolemember [loginmanager], [privacera_policysync];
    
  2. For each targeted database:

    1. Log on to the target database with an Admin role account.

    2. Execute the following:

      IF DATABASE_PRINCIPAL_ID('privacera_policysync') IS NULL BEGIN
        CREATE USER [privacera_policysync] FROM LOGIN [privacera_policysync];
        END;
      
      -- Grant full control on database to privacera_policysync user
      GRANT CONTROL ON DATABASE::${YOUR_DATABASE} TO [privacera_policysync];
      

Access Control on Azure AD and Local Database Users

  1. Confirm the MS SQL Server is configured to work with Azure AD Users.

  2. In your Azure AD, create a Privacera 'service' user to be used by Privacera for the Policy access control synchronization. For this example, we'll assume the name is 'privacera_policysync@example.com' but set the value appropriately for your domain(s). Keep note of the username and password as we'll use both later.

  3. Create a Privacera 'service' user in the master database to be used by Privacera for the Policy access control synchronization. For this example, we'll assume the name is 'privacera_policysync@example.com' but set the value appropriately for your domain(s). Keep note of the username and password as we'll use both later.

    IF DATABASE_PRINCIPAL_ID('privacera_policysync@example.com') IS NULL BEGIN
      CREATE USER [privacera_policysync@example.com] FROM EXTERNAL PROVIDER;
      END;
    
    EXEC sp_addrolemember [loginmanager], [privacera_policysync@example.com];
    
  4. For each targeted database:

    1. Log on to the target database with an Admin role account.

    2. Execute the following:

      IF DATABASE_PRINCIPAL_ID('privacera_policysync@example.com') IS NULL BEGIN
        CREATE USER [privacera_policysync@example.com] FROM EXTERNAL PROVIDER;
        END;
      
      -- Grant full control on database to privacera_policysync@example.com user
      GRANT CONTROL ON DATABASE::${YOUR_DATABASE} TO [privacera_policysync@example.com];
      

3) Create or Identify an ADLS Gen2 storage used to store MS SQL Server Audits

  1. Consult the following article How to Configure MS SQL Server for Database Synapse Audits.

  2. Using information from that article obtain the Audit storage URL. This will be used in the Privacera MS SQL PolicySync configuration.

4) Create an MSSSQL server in AWS RDS to store MSSQL Server Audits

  1. Consult the following article SQL Server Audit.

  2. Using information from that article obtain the Audit storage URL. This will be used in the Privacera MSSQL PolicySync configuration.

CLI Configuration
  1. SSH to the instance where Privacera is installed.

  2. Run the following command.

    cd ~/privacera/privacera-manager/config
    cp sample-vars/vars.policysync.mssql.yml custom-vars/
    vi custom-vars/vars.policysync.mssql.yml
    
  3. Set the properties for your specific installation. For property details and description, see the Configuration Properties section that follows.

    Note

    Along with the above properties, you can add custom properties that are not included by default. For more information about these properties, see .

    There are two properties that establish the type of 'masking' that will be supported for this connector: 'native masking', and 'view-based masking'.

    Native Masking - in MS SQL known as 'Dynamic Data Masking' - is supported directly by MS SQL Server. This level of masking has low granularity and only supports the ability to mask by database for each user. See Microsoft documentation Dynamic Data Masking for more background.

    Privacera Platform supports 'View-based Masking', which for MS SQL supports Row-level filtering and masking. View-based masking is the default and is recommended.

    Property Name

    Value/Comments

    MS SQL_ENABLE_MASKING

    Set to true to enable MS SQL 'native' masking and disable View-based masking functionality.

    MS SQL_ENABLE_VIEW_BASED_MASKING

    Set to true to enable View-based masking functionality.

    MS SQL_UNMASKED_DATA_ROLE

    A comma-separated MS SQL role list for roles authorized for unmasked data. all other users will see masked data.

  4. Run the following commands.

    cd ~/privacera/privacera-manager
    ./privacera-manager.sh update
    
Configuration Properties

JDBC configuration properties

Table 30. JDBC configuration properties

Name

Type

Default

Required

Description

MSSQL_JDBC_URL

string

Yes

Specifies the JDBC URL for the Microsoft SQL Server connector.

Use the following format for the JDBC string:

jdbc:sqlserver://<JDBC_SQLSERVER_URL_WITH_PORT_NUMBER>

MSSQL_JDBC_USERNAME

string

Yes

Specifies the JDBC username to use.

MSSQL_JDBC_PASSWORD

string

Yes

Specifies the JDBC password to use.

MSSQL_MASTER_DB

string

master

Yes

Specifies the name of the JDBC master database that PolicySync establishes an initial connection to.

MSSQL_AUTHENTICATION_TYPE

string

SqlPassword

Yes

Specifies the authentication type for the database engine. The following types are supported:

  • If the user specified by MSSQL_JDBC_USERNAME is a local user, specify: SqlPassword

  • If the user specified by MSSQL_JDBC_USERNAME is a Microsoft Azure Active Directory user, specify: ActiveDirectoryPassword

MSSQL_DEFAULT_USER_PASSWORD

string

Yes

Specifies the password to use when PolicySync creates new users.

MSSQL_OWNER_ROLE

string

No

Specifies the role that owns the resources managed by PolicySync. You must ensure that this user exists as PolicySync does not create this user.

  • If a value is not specified, resources are owned by the creating user. In this case, the owner of the resource will have all access to the resource.

  • If a value is specified, the owner of the resource will be changed to the specified value.

The following resource types are supported:

  • Database

  • Schemas

  • Tables

  • Views



Load keys and intervals

Table 31. Load keys and intervals

Name

Type

Default

Required

Description

MSSQL_LOAD_RESOURCES_KEY

string

load_from_database_columns

No

Specifies how PolicySync loads resources from Microsoft SQL Server. The following values are allowed:

  • load: Load resources from Microsoft SQL Server with a single SQL query.

MSSQL_RESOURCE_SYNC_INTERVAL

integer

60

No

Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.

MSSQL_PRINCIPAL_SYNC_INTERVAL

integer

420

No

Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.

MSSQL_PERMISSION_SYNC_INTERVAL

integer

540

No

Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.

MSSQL_AUDIT_SYNC_INTERVAL

integer

30

No

Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.



Resources management

Table 32. Resources management

Name

Type

Default

Required

Description

MSSQL_MANAGE_DATABASE_LIST

string

No

Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards. Names are case-sensitive.

An example list of databases might resemble the following: testdb1,testdb2,sales db*.

If specified, MSSQL_IGNORE_DATABASE_LIST takes precedence over this setting.

MSSQL_MANAGE_SCHEMA_LIST

string

No

Specifies a comma-separated list of schema names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive.

Use the following format when specifying a schema:

<DATABASE_NAME>.<SCHEMA_NAME>

If specified, MSSQL_IGNORE_SCHEMA_LIST takes precedence over this setting.

If you specify a wildcard, such as in the following example, all schemas are managed:

<DATABASE_NAME>.*

The specified value, if any, is interpreted in the following ways:

  • If unset, access control is managed for all schemas.

  • If set to none no schemas are managed.

MSSQL_MANAGE_TABLE_LIST

string

No

Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive.

Use the following format when specifying a table:

<DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME>

If specified, MSSQL_IGNORE_TABLE_LIST takes precedence over this setting.

If you specify a wildcard, such as in the following example, all matched tables are managed:

<DATABASE_NAME>.<SCHEMA_NAME>.*

The specified value, if any, is interpreted in the following ways:

  • If unset, access control is managed for all tables.

  • If set to none no tables are managed.

MSSQL_IGNORE_DATABASE_LIST

string

No

Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all databases are subject to access control.

For example:

testdb1,testdb2,sales_db*

This setting supersedes any values specified by MSSQL_MANAGE_DATABASE_LIST.

MSSQL_IGNORE_SCHEMA_LIST

string

No

Specifies a comma-separated list of schema names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all schemas are subject to access control.

For example:

testdb1.schema1,testdb2.schema2,sales_db*.sales*

This setting supersedes any values specified by MSSQL_MANAGE_SCHEMA_LIST.

MSSQL_IGNORE_TABLE_LIST

string

No

Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Names are case-sensitive. Specify tables using the following format:

<DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME>

This setting supersedes any values specified by MSSQL_MANAGE_TABLE_LIST.



Users/Groups/Roles management

Table 33. Users/Groups/Roles management

Name

Type

Default

Required

Description

MSSQL_USER_NAME_REPLACE_FROM_REGEX

string

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

No

Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the MSSQL_USER_NAME_REPLACE_TO_STRING setting.

If not specified, no find and replace operation is performed.

MSSQL_USER_NAME_REPLACE_TO_STRING

string

_

No

Specifies a string to replace the characters matched by the regex specified by the MSSQL_USER_NAME_REPLACE_FROM_REGEX setting.

If not specified, no find and replace operation is performed.

MSSQL_GROUP_NAME_REPLACE_FROM_REGEX

string

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

No

Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the MSSQL_GROUP_NAME_REPLACE_TO_STRING setting.

If not specified, no find and replace operation is performed.

MSSQL_GROUP_NAME_REPLACE_TO_STRING

string

_

No

Specifies a string to replace the characters matched by the regex specified by the MSSQL_GROUP_NAME_REPLACE_FROM_REGEX setting.

If not specified, no find and replace operation is performed.

MSSQL_ROLE_NAME_REPLACE_FROM_REGEX

string

[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]

No

Specifies a regular expression to apply to a role name and replaces each matching character with the value specified by the MSSQL_ROLE_NAME_REPLACE_TO_STRING setting.

If not specified, no find and replace operation is performed.

MSSQL_ROLE_NAME_REPLACE_TO_STRING

string

_

No

Specifies a string to replace the characters matched by the regex specified by the MSSQL_ROLE_NAME_REPLACE_FROM_REGEX setting.

If not specified, no find and replace operation is performed.

MSSQL_USER_NAME_PERSIST_CASE_SENSITIVITY

boolean

false

No

Specifies whether PolicySync converts user names to lowercase when creating local users. If set to true, case sensitivity is preserved.

MSSQL_GROUP_NAME_PERSIST_CASE_SENSITIVITY

boolean

false

No

Specifies whether PolicySync converts group names to lowercase when creating local groups. If set to true, case sensitivity is preserved.

MSSQL_ROLE_NAME_PERSIST_CASE_SENSITIVITY

boolean

false

No

Specifies whether PolicySync converts role names to lowercase when creating local roles. If set to true, case sensitivity is preserved.

MSSQL_USER_NAME_CASE_CONVERSION

string

lower

No

Specifies how user name conversions are performed. The following options are valid:

  • lower: Convert to lowercase

  • upper: Convert to uppercase

  • none: Preserve case

This setting applies only if MSSQL_USER_NAME_PERSIST_CASE_SENSITIVITY is set to true.

MSSQL_GROUP_NAME_CASE_CONVERSION

string

lower

No

Specifies how group name conversions are performed. The following options are valid:

  • lower: Convert to lowercase

  • upper: Convert to uppercase

  • none: Preserve case

This setting applies only if MSSQL_GROUP_NAME_PERSIST_CASE_SENSITIVITY is set to true.

MSSQL_ROLE_NAME_CASE_CONVERSION

string

lower

No

Specifies how role name conversions are performed. The following options are valid:

  • lower: Convert to lowercase

  • upper: Convert to uppercase

  • none: Preserve case

This setting applies only if MSSQL_ROLE_NAME_PERSIST_CASE_SENSITIVITY is set to true.

MSSQL_USER_FILTER_WITH_EMAIL

string

No

Set this property to true if you only want to manage users who have an email address associated with them in the portal.

MSSQL_MANAGE_USERS

boolean

false

No

Specifies whether PolicySync maintains user membership in roles in the Microsoft SQL Server data source.

MSSQL_MANAGE_GROUPS

boolean

false

No

Specifies whether PolicySync creates groups from Privacera in the Microsoft SQL Server data source.

MSSQL_MANAGE_ROLES

boolean

false

No

Specifies whether PolicySync creates roles from Privacera in the Microsoft SQL Server data source.

MSSQL_MANAGE_USER_LIST

string

No

Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive.

If not specified, PolicySync manages access control for all users.

If specified, MSSQL_IGNORE_USER_LIST takes precedence over this setting.

An example user list might resemble the following: user1,user2,dev_user*.

MSSQL_MANAGE_GROUP_LIST

string

No

Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive.

An example list of projects might resemble the following: group1,group2,dev_group*.

If specified, MSSQL_IGNORE_GROUP_LIST takes precedence over this setting.

MSSQL_MANAGE_ROLE_LIST

string

No

Specifies a comma-separated list of role names for which PolicySync manages access control. If unset, access control is managed for all roles. If specified, use the following format. You can use wildcards. Names are case-sensitive.

An example list of projects might resemble the following: role1,role2,dev_role*.

If specified, MSSQL_IGNORE_ROLE_LIST takes precedence over this setting.

MSSQL_IGNORE_USER_LIST

string

No

Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all users are subject to access control.

This setting supersedes any values specified by MSSQL_MANAGE_USER_LIST.

MSSQL_IGNORE_GROUP_LIST

string

No

Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all groups are subject to access control.

This setting supersedes any values specified by MSSQL_MANAGE_GROUP_LIST.

MSSQL_IGNORE_ROLE_LIST

string

No

Specifies a comma-separated list of role names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all roles are subject to access control.

This setting supersedes any values specified by MSSQL_MANAGE_ROLE_LIST.

MSSQL_USER_ROLE_PREFIX

string

priv_user_

No

Specifies the prefix that PolicySync uses when creating local users. For example, if you have a user named <USER> defined in Privacera and the role prefix is priv_user_, the local role is named priv_user_<USER>.

MSSQL_GROUP_ROLE_PREFIX

string

priv_group_

No

Specifies the prefix that PolicySync uses when creating local roles. For example, if you have a group named etl_users defined in Privacera and the role prefix is prefix_, the local role is named prefix_etl_users.

MSSQL_ROLE_ROLE_PREFIX

string

priv_role_

No

Specifies the prefix that PolicySync uses when creating roles from Privacera in the Microsoft SQL Server data source.

For example, if you have a role in Privacera named finance defined in Privacera and the role prefix is role_prefix_, the local role is named role_prefix_finance.

MSSQL_USE_NATIVE_PUBLIC_GROUP

boolean

false

No

Specifies whether PolicySync uses the Microsoft SQL Server native public group for access grants whenever a policy refers to a public group. The default value is false.

MSSQL_MANAGE_USER_FILTERBY_GROUP

boolean

false

No

Specifies whether to manage only the users that are members of groups specified by MSSQL_MANAGE_GROUP_LIST. The default value is false.

MSSQL_MANAGE_USER_FILTERBY_ROLE

boolean

false

No

Specifies whether to manage only users that are members of the roles specified by MSSQL_MANAGE_ROLE_LIST. The default value is false.



Native Row filter

Table 34. Native Row filter

Name

Type

Default

Required

Description

MSSQL_ENABLE_ROW_FILTER

boolean

false

No

Specifies whether to use the data source native row filter functionality. This setting is disabled by default. When enabled, you can create row filters only on tables, but not on views.

MSSQL_ENABLE_VIEW_BASED_MASKING

boolean

true

No

Specifies whether to use secure view based masking. The default value is true.

MSSQL_ENABLE_VIEW_BASED_ROW_FILTER

boolean

true

No

Specifies whether to use secure view based row filtering. The default value is true.

While Microsoft SQL Server supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.

MSSQL_SECURE_VIEW_CREATE_FOR_ALL

boolean

true

No

Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.

MSSQL_MASKED_NUMBER_VALUE

integer

0

No

Specifies the default masking value for numeric column types.

MSSQL_MASKED_TEXT_VALUE

string

<MASKED>

No

Specifies the default masking value for text and string column types.

MSSQL_MASKED_DATE_VALUE

string

null

No

Specifies the default masking value for date column types.

MSSQL_SECURE_VIEW_NAME_PREFIX

string

No

Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.

If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a table named example1 is dev_example1.

MSSQL_SECURE_VIEW_NAME_POSTFIX

string

_secure

No

Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.

If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a table named example1 is example1_dev.

MSSQL_SECURE_VIEW_SCHEMA_NAME_PREFIX

string

No

Specifies a prefix string to apply to a secure schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.

If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view schema name for a schema named example1 is dev_example1.

MSSQL_SECURE_VIEW_SCHEMA_NAME_POSTFIX

string

No

Specifies a postfix string to apply to a secure view schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.

If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a schema named example1 is example1_dev.

MSSQL_SECURE_VIEW_NAME_REMOVE_SUFFIX_LIST

string

No

Specifies a suffix to remove from a table or view name. For example, if the table is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied.

You can specify a single suffix or a comma separated list of suffixes.

MSSQL_SECURE_VIEW_SCHEMA_NAME_REMOVE_SUFFIX_LIST

string

No

Specifies a suffix to remove from a schema name. For example, if a schema is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied.

You can specify a single suffix or a comma separated list of suffixes.

MSSQL_GRANT_UPDATES

boolean

true

Yes

Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is true.

MSSQL_GRANT_UPDATES_MAX_RETRY_ATTEMPTS

integer

2

No

Specifies the maximum number of attempts that PolicySync makes to execute a grant query if it is unable to do so successfully. The default value is 2.

MSSQL_ENABLE_DATA_ADMIN

boolean

true

No

This property is used to enable the data admin feature. With this feature enabled you can create all the policies on native tables/views, and respective grants will be made on the secure views of those native tables/views. These secure views will have row filter and masking capability. In case you need to grant permission on the native tables/views then you can select the permission you want plus data admin in the policy. Then those permissions will be granted on both the native table/view as well as its secure view.



Access audits management

Table 35. Access audits management

Name

Type

Default

Required

Description

MSSQL_AUDIT_ENABLE

boolean

false

Yes

Specifies whether Privacera fetches access audit data from the data source.

If specified, you must specify a value for the MSSQL_AUDIT_STORAGE_URL setting.

MSSQL_AUDIT_STORAGE_URL

string

No

Specifies the URL for the audit logs provided by the Azure SQL Auditing service. For example: https://test.blob.core.windows.net/sqldbauditlogs/test

MSSQL_AUDIT_INITIAL_PULL_MINUTES

integer

30

No

Specifies the initial delay, in minutes, before PolicySync retrieves access audits from Microsoft SQL Server.

MSSQL_AUDIT_LOAD_KEY

string

load

No

Specifies the method that PolicySync uses to load access audit information.

The following values are valid:

  • load: If your data source is Microsoft SQL Server, set this value to use SQL queries to load access audit information.

  • load_aws: If your data source is Amazon RDS for SQL Server, set this value to load access audit information.

  • load_synapse: If your data source is Microsoft Azure Synapse, set this value to load access audit information.

MSSQL_USER_LOAD_KEY

string

load

No

Specifies how PolicySync loads users from Microsoft SQL Server. The following values are valid:

  • load

  • load_db

MSSQL_EXTERNAL_USER_AS_INTERNAL

boolean

false

No

Specifies whether PolicySync creates local users for external users.

MSSQL_AUDIT_EXCLUDED_USERS

string

No

Specifies a comma separated list of users to exclude when fetching access audits. For example: "user1,user2,user3".

MSSQL_MANAGE_GROUP_POLICY_ONLY

boolean

false

No

Specifies whether access policies apply to only groups. If enabled, any policies that apply to users or roles are ignored.