# Microsoft SQL Server

This guide shows you how to read events from Microsoft SQL Server and Azure SQL Databases with Tenzir.

Use [`from_microsoft_sql`](https://preview.docs.tenzir.com/375/375/reference/operators/from_microsoft_sql.md) to connect to Microsoft SQL Server over the Tabular Data Stream (TDS) protocol. The operator can read a full table, execute a custom query, list table metadata, or poll a table for newly inserted rows.

## Connect to Azure SQL

Azure SQL Database accepts TDS connections on port `1433` and requires TLS. Use the server host name from Azure, usually in the form `<server>.database.windows.net`, and set `tls=true`.

```tql
from_microsoft_sql query="SELECT TOP 10 * FROM dbo.events",
                   host="example.database.windows.net",
                   port=1433,
                   user="tenzir_reader",
                   password=secret("azure-sql-password"),
                   database="security",
                   tls=true
```

The operator currently supports SQL authentication. Microsoft Entra authentication, managed identities, Windows authentication, and Kerberos are not supported.

## Read from SQL Server

Use `table` to read every row from a table:

```tql
from_microsoft_sql table="dbo.events",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true
```

Use `query` or `sql` when you want to select, filter, or join data in SQL Server before Tenzir receives it:

```tql
from_microsoft_sql query=r"SELECT id, created_at, source, message
                          FROM dbo.events
                          WHERE severity >= 3",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true
```

## Stream new rows

Set `live=true` to poll a table for newly inserted rows. Live mode uses a monotonic integer tracking column as a watermark. If you don’t specify `tracking_column`, the operator tries to detect a single integer identity column or a single integer primary-key column.

```tql
from_microsoft_sql table="dbo.events",
                   live=true,
                   tracking_column="id",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true
```

Live mode initializes its watermark from the current maximum tracking value and then emits rows with greater values. It doesn’t emit an initial snapshot, and it doesn’t capture updates or deletes.

## Inspect metadata

List all base tables in the selected database:

```tql
from_microsoft_sql show="tables",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true
```

List columns for a table:

```tql
from_microsoft_sql show="columns",
                   table="dbo.events",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true
```

## See Also

* [`from_microsoft_sql`](https://preview.docs.tenzir.com/375/375/reference/operators/from_microsoft_sql.md)