Database Watcher - Not able to connect and collect data from Azure SQL Database

We followed all the steps. We are not getting any error just it doesn't show any database.

We followed all the steps. We are not getting any error just it doesn't show any database.

Hi Mitesh Prajapati

Thank you for getting back to me with your results.

Kindly request you to please share the details requested over the private message for further investigation.

Hi Mitesh Prajapati

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Hi Mitesh Prajapati

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

How can we provide private responses? as we would not like to share all the details here.

@Anonymous Is it possible to setup a call? we can show you all the details over a call.

Hi Mitesh Prajapati

Thank you for your response.

I have escalated this thread to the next level, and the specialized team is currently investigating the issue. @Pratik Lad will contact you soon with expected solution.

Thank you.

Hi Mitesh Prajapati

If you're having trouble seeing your databases on the Database Watcher dashboard while using SQL authentication, it’s important to double-check that you've completed all the necessary configuration steps.

Key Vault Configuration:

• First things first, make sure you're using an Azure Key Vault that’s set up with the RBAC permission.
• If you need private connectivity, don’t forget to create and approve a private endpoint to the vault.
• For public connectivity, ensure that the vault is configured to allow access from all networks, as restricting it to specific networks isn’t supported.

SQL Authentication Setup:

• You’ll need to create a SQL authentication login on each Azure SQL logical server or managed instance that you want to monitor.
• To grant limited permissions, run the following T-SQL script in the master database as a server admin:

CREATE LOGIN [login-name-placeholder] WITH PASSWORD = 'password-placeholder'; 
ALTER SERVER ROLE ##MS_ServerPerformanceStateReader## ADD MEMBER [login-name-placeholder]; 
ALTER SERVER ROLE ##MS_DefinitionReader## ADD MEMBER [login-name-placeholder]; 
ALTER SERVER ROLE ##MS_DatabaseConnector## ADD MEMBER [login-name-placeholder]; 

Secrets in Azure Key Vault:

• Next, create two secrets: one for the login name and another for the password (for example, database-watcher-login-name and database-watcher-password).
• Make sure you have the Key Vault Secrets Officer role to create these secrets.

Add SQL Target in Database Watcher:

When you’re adding a SQL target, remember to:

• Check the box for "Use SQL authentication."
• Select the appropriate Key Vault.
• Enter the secret names (not the actual login or password) for both the login name and password.

Permissions to Access Secrets:

If the current user isn’t an Owner or User Access Administrator on the vault, you’ll need to manually grant the watcher’s managed identity access:

• Navigate to Access Control (IAM) on each secret. >> Assign the Key Vault Secrets User role to the watcher’s managed identity.

By carefully following these steps, your databases should start showing up in the Database Watcher dashboard.

Hi Mitesh Prajapati

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Hi Mitesh Prajapati

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Hi @PratikLad It did not work for us after following all the exact steps provided. would it be better to schedule a call to discuss this?

I'm having the same problem to collect data of Azure SQL databases. Those are things I've checked:

• Watcher is running.
• Watcher has access to the data store (as Admin).
• Data Explorer cluster is running.
• Watcher has access to the SQL targets (using Microsoft Entra authentication and privilege script generated by Watcher portal).
• Microsoft Entra is enabled on the SQL Target.
• I'm using private connectivity. I've created Managed endpoints for each SQL Target and they have been approved.
• Private endpoint also configured on the Data Explorer cluster.
• The Azure Data Explorer database exists. I can run a query on the database and I can see the Watcher has Admin privilege and I myself have Viewer privilege.

Is there anything else that I can check?