AzureFeeds

Hi all,

In this article, you can find a way to retrieve database permission from all your onboarded databases through Azure Arc. This idea is born from a customer request around maintaining a standard permission set, in a very wide environment (about 1000 SQL server).

This solution is based on Azure Arc, so first you need to onboard your SQL server to Azure Arc and enable the SQL server extension. If you want to test Azure Arc in a test environment, you can use the Azure Jumpstart, in this repo you will find ready-to-deploy arm templates the deploy demos environments.

The other solution components are an automation account, log analytics and a Data collection rule endpoint. Here you can find a little recap of the purpose of each component:

• 
  

  Automation account: with this resource you can run and schedule a PowerShell script, and you can also store the credentials securely

  
  


• 
  

  Log Analytics workspace: here you will create a custom table and store all the data that comes from the script

  
  


• 
  

  Data collection Endpoint / Data Collection Rule: enable you to open a public endpoint to allow you to ingest collected data on Log analytics workspace

  
  

 

In this section you will discover how I composed the six phases of the script:

1. 
   

   Obtain the bearer token and authenticate on the portal: First of all you need to authenticate on the azure portal to get all the SQL instance and to have to token to send your assessment data to log analytics

   
   

    

   
   

$tenantId = “XXXXXXXXXXXXXXXXXXXXXXXXXXX”
$cred = Get-AutomationPSCredential -Name ‘appreg’
Connect-AzAccount -ServicePrincipal -Tenant $tenantId -Credential $cred
$appId = $cred.UserName
$appSecret = $cred.GetNetworkCredential().Password
$endpoint_uri = “https://sampleazuremonitorworkspace-weu-a5x6.westeurope-1.ingest.monitor.azure.com” #Logs ingestion URI for the DCR
$dcrImmutableId = “dcr-sample2b9f0b27caf54b73bdbd8fa15908238799” #the immutableId property of the DCR object $streamName = “Custom-MyTable”
$scope= [System.Web.HttpUtility]::UrlEncode(“https://monitor.azure.com//.default”)
$body = “client_id=$appId&scope=$scope&client_secret=$appSecret&grant_type=client_credentials”; $headers = @{“Content-Type”=”application/x-www-form-urlencoded”}; $uri = “https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token”
$bearerToken = (Invoke-RestMethod -Uri $uri -Method “Post” -Body $body -Headers $headers).access_token

 

2. 
   

   Get all the SQL instances: in my example I took all the instances, you can also use a tag to filter some resources, for example if a want to assess only the production environment you can use the tag as a filter

   
   

 

$servers = Get-AzResource -ResourceType “Microsoft.AzureArcData/SQLServerInstances”

 

3. 
   

   When you have all the SQL instance you can run your t-query to obtain all the permission , remember now we are looking for the permission, but you can use for any query you want or in other situation where you need to run a command on a generic server

   
   

 

$SQLCmd = @’ Invoke-SQLcmd -ServerInstance . -Query “USE master; BEGIN IF LEFT(CAST(Serverproperty(‘ProductVersion’) AS VARCHAR(1)),1) = ‘8’ begin IF EXISTS (SELECT TOP 1 * FROM tempdb.dbo.sysobjects (nolock) WHERE name LIKE ‘#TUser%’) begin DROP TABLE #TUser end end ELSE begin IF EXISTS (SELECT TOP 1 * FROM tempdb.sys.objects (nolock) WHERE name LIKE ‘#TUser%’) begin DROP TABLE #TUser end end CREATE TABLE #TUser (DBName SYSNAME,[Name] SYSNAME,GroupName SYSNAME NULL,LoginName SYSNAME NULL,default_database_name SYSNAME NULL,default_schema_name VARCHAR(256) NULL,Principal_id INT); IF LEFT(CAST(Serverproperty(‘ProductVersion’) AS VARCHAR(1)),1) = ‘8’ INSERT INTO #TUser EXEC sp_MSForEachdb ‘ SELECT ”?” as DBName, u.name As UserName, CASE WHEN (r.uid IS NULL) THEN ”public” ELSE r.name END AS GroupName, l.name AS LoginName, NULL AS Default_db_Name, NULL as default_Schema_name, u.uid FROM [?].dbo.sysUsers u LEFT JOIN ([?].dbo.sysMembers m JOIN [?].dbo.sysUsers r ON m.groupuid = r.uid) ON m.memberuid = u.uid LEFT JOIN dbo.sysLogins l ON u.sid = l.sid WHERE (u.islogin = 1 OR u.isntname = 1 OR u.isntgroup = 1) and u.name not in (”public”,”dbo”,”guest”) ORDER BY u.name ‘ ELSE INSERT INTO #TUser EXEC sp_MSforeachdb ‘ SELECT ”?”, u.name, CASE WHEN (r.principal_id IS NULL) THEN ”public” ELSE r.name END GroupName, l.name LoginName, l.default_database_name, u.default_schema_name, u.principal_id FROM [?].sys.database_principals u LEFT JOIN ([?].sys.database_role_members m JOIN [?].sys.database_principals r ON m.role_principal_id = r.principal_id) ON m.member_principal_id = u.principal_id LEFT JOIN [?].sys.server_principals l ON u.sid = l.sid WHERE u.TYPE ”R” and u.TYPE ”S” and u.name not in (”public”,”dbo”,”guest”) order by u.name ‘; SELECT DBName, Name, GroupName,LoginName FROM #TUser where Name not in (‘information_schema’) and GroupName not in (‘public’) ORDER BY DBName,[Name],GroupName; DROP TABLE #TUser; END” ‘@

$command = New-AzConnectedMachineRunCommand -ResourceGroupName “test_query” -MachineName $server1 -Location “westeurope” -RunCommandName “RunCommandName” -SourceScript $SQLCmd

 

4. 
   

   In a second, you will receive the output of the command, and you must send it to the log analytics workspace (aka LAW). In this phase, you can also review the output before sending it to LAW, for example, removing some text or filtering some results. In my case, I’m adding the information about the server where the script runs to each record.

   
   

$array = ($command.InstanceViewOutput -split “r?n” | Where-Object { $.Trim() }) | ForEach-Object { $line = $ -replace ”, ” ù$array = $array | Where-Object { $_ -notmatch “DBName,Name,GroupName,LoginName” } | Where-Object {$_ -notmatch “——“}

 

5. 
   

   The last phase is designed to send the output to the log analytics workspace using the dce dcr.

   
   

$staticData = @”
[{
“TimeGenerated”: “$currentTime”,
“RawData”: “$raw”,
}]”@;
$body = $staticData;
$headers = @{“Authorization”=”Bearer $bearerToken”;”Content-Type”=”application/json”};
$uri = “$endpoint_uri/dataCollectionRules/$dcrImmutableId/streams/$($streamName)?api-version=2023-01-01”
$rest = Invoke-RestMethod -Uri $uri -Method “Post” -Body $body -Headers $headers

 

6. 
   

   When the data arrives in log analytics workspace, you can query this data, and you can create a dashboard or why not an alert.

   
   

 

 

Now you will see how you can implement this solution. For the log analytics, dce and dcr, you can follow the official docs:

Tutorial: Send data to Azure Monitor Logs with Logs ingestion API (Resource Manager templates) – Azure Monitor | Microsoft Learn

After you create the dcr and the log analytics workspace with its custom table. You can proceed with the Automation account.

Create an automation account using the creating wizard

 

You can proceed with the default parameter.

When the Automation Account creation is completed, you can create a credential in the Automation Account. This allows you to avoid the exposition of the credential used to connect to Azure

 

 

 

 You can insert here the enterprise application and the key.

Now you are ready to create the runbook (basically the script that we will schedule)

 

 

 

You can give the name you want and click create.

Now go in the automation account à Runbooks and Edit in Portal, you can copy your script or the script in this link.

Remember to replace your tenant ID, you will find in EntraID section and the Enterprise application

 

 

 

You can test it using the Test Pane function and when you are ready you can Publish and link a schedule, for example daily at 5am.

Remember, today we talked about database permissions, but the scenarios are endless: checking a requirement, deploying a small fix, or removing/adding a configuration — at scale.

At the end, as you see, Azure Arc is not only another agent, is a chance to empower every environment (and every other cloud provider 😉) with Azure technology.

 

See you in the next techie adventure.