Press "Enter" to skip to content

Category: Security

Using Direct Lake across Public and Private Link Workspaces

Published 2026-10-29 by Kevin Feasel

Gilbert Quevauvilliers gets all of the data:

Currently in the Microsoft documentation it talks to not being able to connect from a Public Workspace to a Private Link workspace using DirectLake to a Semantic Model.

What this means in my mind is it is where it is a direct connection from a Public Workspace to a Private Link workspace

NOTE: A Private Link workspace is where inbound connectivity is blocked from the public internet.

In this blog post I am going to show you how to work around this, where at the end I will show you how you can still use DirectLake for a Semantic Model between a Public and Private Link Workspace.

Read on for the solution.

Leave a Comment

Using Managed Identities to Write Backups to Azure

Published 2026-10-16 by Kevin Feasel

Warwick Rudd continues a series:

In Part 1 we built somewhere safe to put the backups: a storage account with a delete lock and a container with a time-based retention policy.

The next problem is getting SQL Server to write to it without giving it a password. That’s what the Managed Identity is for. The VM gets an identity in Microsoft Entra ID, SQL Server uses it to authenticate to storage, and there’s no SAS token or storage key anywhere to steal, rotate or forget about.

There are a few moving parts to get there, and most of the time spent on this is in Entra ID and networking rather than SQL Server.

Read on to see what needs to happen.

Leave a Comment

The Power of Group Managed Service Accounts

Published 2026-10-14 by Kevin Feasel

John Sterrett gets rid of a password:

Somewhere in your environment, a SQL Server service account password hasn’t changed in years. Several people know it, and it’s probably in a script or a spreadsheet. I wouldn’t be surprised if someone hasn’t even put it in an AI chat.  Group managed service accounts (gMSAs) remove that problem.

This past weekend, during my Advanced Security Protection talk (online version you can watch) at Days of Data in Pittsburgh, someone asked: “What are the best practices for encrypting passwords in connection strings?” That reminded me I’m overdue to blog about Group Managed Service Accounts, so here we are, because the best way to encrypt them is to not need to encrypt them.

This does get a lot trickier if you’re not on Windows, and it does require Active Directory. But for most environments, gMSAs are an outstanding idea.

Leave a Comment

Securing Temporary Objects, Metadata Visibility, and Audit Assurance in SQL Server

Published 2026-10-12 by Kevin Feasel

Fabiano Amorim hits three topics:

Over the course of this series, I’ve challenged the common assumption that a SQL Server environment is safe simply because it’s patched, firewalled, and configured according to familiar defaults.

I’ve proven that this is not quite true, because real security is not a checkbox. It requires a verification mindset, especially in areas where SQL Server intentionally provides powerful operational features for DBAs, developers, monitoring tools, and application frameworks. 

In this guide, I’ll focus on three features that are easy to underestimate because they look like normal SQL Server behavior. They are global temporary objects, Dynamic Management Views (DMVs), and audit coverage – each a useful feature in their own right.

The other thing they all have in common? They can each become part of an attack chain if granted too broadly, used inside privileged workflows, or trusted without validation. 

Click through for Fabiano’s guidance.

Leave a Comment

SQL Copilot “Read-Only” Mode Wasn’t

Published 2026-10-08 by Kevin Feasel

Rebecca Lewis reads a CVE:

I was in Italy for a month. While I was gone, somebody got sysadmin out of SQL Copilot with a variable.

The vulnerability is CVE-2026-65669, the SSMS 22 Copilot bug I wrote about early September. The full write-up went public on September 30th, and the detail that stuck with me is how Copilot’s ‘read-only mode’ was enforced. It wasn’t a permission. It was a regex blocklist.

That blocklist is the same control we have watched fail against SQL injection for twenty years. Before I get to Copilot, let’s build one here and see it fail.

These sorts of blacklists almost never work against a committed attacker because, unless you fully enumerate the possible domain, there’s an opportunity for someone to slip through, and that’s exactly what happened here.

Comments closed

Securing MCP Servers Connected to a Database

Published 2026-10-06 by Kevin Feasel

Dejan Lukic shares some advice:

AI agents don’t ask permission before every query. Instead, they themselves decide which tools to call and chain together. That’s a fundamentally different risk model than traditional access control – and it’s exactly why MCP (Model Context Protocol) servers connected to databases need their own security playbook.

This guide covers the failure modes to watch for: confused deputy, token passthrough, prompt injection, over-scoped credentials, and session hijacking. Then, how to prevent those failure modes – using authentication, authorization, and least-privilege controls.

Treat them like any other often-confused employee. Which, in many environments, means making them sysadmins.

Comments closed

In-Memory DLLs and Digital Signatures

Published 2026-10-05 by Kevin Feasel

Emad Al-Mousa leaves a note:

While a valid cryptographic digital signature ensures the authenticity and integrity of a compiled binary, targeting dynamic database runtime components—such as In-Memory OLTP (XTP) directories—presents a severe attack vector if integrity controls are bypassed.

Because database services like SQL Server frequently operate under high-privilege service accounts (such as NT AUTHORITY\SYSTEM or a high-privileged virtual account), an adversary who achieves local administrative access could attempt to substitute or hijack dynamic runtime DLLs. A successful payload injection into the SQL Server process memory (sqlservr.exe) would inherit the service’s privileges, facilitating arbitrary code execution, local privilege escalation to SYSTEM, or the establishment of an outbound reverse shell.

Click through for a demonstration and Microsoft Security’s response.

Comments closed

Viewing Histogram Data of Sensitive Postgres Databases

Published 2026-10-02 by Kevin Feasel

Emad Al-Mousa finds a way around:

Adversaries continuously exploit every available vector to exfiltrate sensitive data while evading detection. This risk is magnified because critical threats originate from both external cybercriminals and trusted insiders.

To counter this, robust database auditing acts as a foundational line of defense, enforcing tailored policies that align with corporate security and compliance mandates. By streaming these granular audit logs directly to a SIEM solution, Security Operations Center (SOC) analysts gain real-time visibility to spot anomalous queries and unauthorized modifications. Furthermore, these logs serve as an immutable evidentiary trail for post-incident forensics. Ensuring that the database security and logging engine functions reliably is therefore non-negotiable for enterprise risk mitigation, rapid incident response, and regulatory compliance.

The quick idea is that you can view database histogram data without tripping audit logs, and those histograms might contain some amount of the sensitive data that you don’t want people to see.

Comments closed

A Quick Primer on Microsoft Entra ID

Published 2026-09-29 by Kevin Feasel

Jordan Boich gives us a high-level overview:

As a DBA with on-prem and cloud experience, I feel confident in saying that I’m fairly well versed on the “DBA Domain” part of the shared responsibility model. However, if we really want to do our jobs right as data professionals, having an understanding of the entire infrastructure does wonders when it comes to making architectural decisions that can impact the entire system.

The struggle I’ve experienced being a DBA is that hearing things like “Entra ID” or “Microsoft Entra Domain Services” has me sitting in a position where I know of those things because I’ve been around it for years but not really having as deep of an understanding as I’d like to. In this post, I’m going to talk a bit about authorization, and authentication from the cloud perspective, specifically Azure, so that other fellow DBAs and data professionals can gain some insight, see what it looks like to operate in the Entra Admin Portal, and show that it’s not as overwhelming as I thought it would be.

Read on to learn more.

Comments closed

Operational Blind Spots in SQL Server Security

Published 2026-09-28 by Kevin Feasel

Fabiano Amorim offers some advice:

The SQL Server attack pattern is consistent: attackers do not always need a spectacular vulnerability. They often succeed by chaining normal features that were granted too broadly, trusted too much, or monitored too narrowly. 

In this article, I’ll focus on operational blind spots in SQL Server. These are the features DBAs use every day to keep SQL Server healthy: linked servers, traces, Dynamic Management Views, Extended Events, and session-management commands such as KILL.

These tools, while necessary, also create visibility, automation, and trust paths that attackers can abuse after compromising a low-privileged application account or a local database owner. 

Because of this, a SQL Server DBA should know the answer to the following questions at all times: where am I exposed, what should I monitor, and what should I change first? In this article, you’ll learn the answers to all three.

Click through for the advice.

Comments closed