0

With the move to Azure Cloud things are moving fast! I have a question based on Azure VM with a shared SQL Server containing multiple instances.

For example if a Azure VM has 5 instances on there each with different databases, and a vendor logs in to our Azure VM is there a way to lock down what they can access? I know you can assign DB_Roles for the vendor to only view the database they need, but how about for drives and the files within those drives?

|improve this question
  • I would highly recommend against giving a vendor RDP access to the VM at all. And if, for some reason, it is required - put their stuff on a dedicated VM. Too many possible issues where this goes horribly wrong for you. – LowlyDBA Jul 16 '19 at 14:51
  • Normally they would not need RDP access or personal access to any drives and files. You can grant them appropriate access to a SQL instance, and grant that SQL Server instance (using the per-service SID) access to any local files and folders it needs. – David Browne - Microsoft Jul 16 '19 at 15:06
  • @DavidBrowne-Microsoft Thank you for your reply. Now for example say if we have one instance on that Azure VM with multiple databases connected to it, can I set the SQL Server Instance accordingly to the users login? E.G we have the D: drive where the data files are stored for lets say 10 databases attached to instance X, can I hide the rest of the 9 data files from the vendor who has logged in to view their own database? – Vishal Jul 16 '19 at 15:28
  • @LowlyDBA Some of our SQL DB's require the vendors to log in and view stuff. Could you eloboarte further when you say put them on a dedicated VM? Thanks! – Vishal Jul 16 '19 at 15:30
  • I think it would be better if you explained why they need to login to the VM? If they don't, then David's response is the direction you need to go. – LowlyDBA Jul 16 '19 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.